Other Log Shippers

If your favorite log shipper is not available, chances are it is still compatible or configurable enough to send data to Humio.

Humio supports the following APIs and tools for data ingestion:

Humio Ingest API

Humio has an Ingest API. You can use this to build an integration with Humio.

ElasticSearch Bulk API

Humio is compatible with the ElasticSearch bulk ingest API.

If you have a log shipper that supports the ElasticSearch Bulk API, there is a good chance that you can use this to send logs to Humio. See the Elastic Beats documentation for an example of configuration options.

Graylog Extended Log Format (GELF)

Humio is compatible with the Graylog Extended Log Format (GELF) using UDP or TCP as transport. Refer to Ingest Listeners to setup such a listener.

GELF over HTTP is not yet implemented.

StatsD

The StatsD protocol is a great way of shipping raw metrics to Humio from a lot of tools. Both UDP and TCP transport are supported. Currently, StatsD protocol is only supported in self-hosted installations.

The StatsD format is very simple. In its simplest form it looks something like <metricname>:<metricvalue>|<metrictype>.

Start by Creating a Parser with the following regex:

humio
(?<metricname>\w+?):(?<metricvalue>[-+]?[\d\.]+?)\|(?<metrictype>\w+?)(\|@(?<metricsampling>[\d\.]+?))?

And no Parse timestamp and Parse key values. Give it a name, like statsd. Next, create an Ingest Listeners with the statsd parser.

We strongly recommend using an UDP ingest listener for non-aggregated StatsD data.

OpenTelemetry

Humio supports OpenTelemetry, or otel, a tool for ingesting telemetry data (logs, metrics, and traces) into Humio. The supported method is called otlphttp in the form of binary-encoded Protobuf — however, if the source uses a different protocol, such as otlp or otlphttp with the JSON-encoded Protobuf format, it must be routed through the OpenTelemetry Collector.

For authentication, an authorization header with the ingest token is used:Authorization: "Bearer <ingest token>".The data that is ingested will be translated into a JSON structure, and afterwards Parsers can be applied.

OpenTelemetry works very well when it comes to ingesting logs into Humio. Furthermore, since Humio is a good storage solution, it is also useful to ingest traces and metrics. Due to how Humio handles event data, some metrics are treated as normal Humio events and some traces might require additional effort on the query language.

The following example shows how to configure an exporter to Humio. This exporter is supported by the traces, metrics, and logs pipelines. It will be automatically routed to the correct place within Humio.

humio
exporters:

  otlphttp:
    endpoint: "http://<url>/api/v1/ingest/otlp"
    headers:
      Authorization: "Bearer <ingest token>"