Tools, query, dashboards and widgets to extend the utility and expand your query repertoire

Packages enable you to share sets of components — parsers, queries, dashboards — by collecting them together into a single package. Users can create packages, and Humio provides a marketplace for sharing and distributing Packages with the community.

For instance, as an nginx user, the humio/nginx package provides you with a collection of parsers, queries, and alert template that help you get started working with nginx logs.

Package Types

There are two types of packages:

  • Libraries define a set of components that you can use as templates for creating new components within Humio.

  • Applications include the templates, but also install collection of the library components deployed within your Humio environment.

Packages can contain parsers, queries, dashboards, actions, and alerts.


A package library is a collection of component templates and extensions, for example dashboards, saved queries, alerts, or parsers. After installing a library within Humio these templates will be available as the basis for creating a new component. Libraries do not provide components that provide functionality, only templates for building new components that you can customize to suit your requirements.

Figure 160. Package Structure

You can use libraries to share common functionality across several repositories. For example, you could create a package that provides useful queries and templates that match your organization requirements for the metrics you need to monitor. Installing the library provides the core functionality which is then customized for the data in each repository.


Applications are bundles of components that provide a set of functionality to support the use of Humio for a specific logging environment or application. Using a package, you can install a collection of dashboards and parsers designed to work and extract the data and display it effectively for a given technology stack.

graph LR; subgraph "Package: Application" S2[Version] S1[Readme] subgraph "Templates" T1["Dashboards"] T2["Saved Queries"] T3["Parsers"] T4["Alerts"] end subgraph " " A1["Dashboards"] A2["Saved Queries"] A3["Parsers"] A4["Alerts"] T1 -.-> A1 T2 -.-> A2 T3 -.-> A3 T4 -.-> A4 end

Figure 161. Packages - Applications

Using a package is a great way to populate your Humio deployment with the tools required to support the rest of your infrastructure. For example, a package might contain all of the queries, widgets and dashboards required to manage and monitor your infrastructure, without you needing to determine or develop your own set. Application Packages can provide a solid starting point that you can customize to fit your needs.

Unlike a package library, an application actually creates and maintains the dashboards, alerts etc to support the events from the monitored application. These components are visible alongside your own items in e.g. the Dashboard List or under Alerts where they are displayed separate from other components categorized by the package they come from.

Creating Packages

You can create your own packages based on components available in Humio, including by creating or using your own queries, widgets and components. This functionality enables you to create a standard set of components that you can then use on your Humio clusters, or to distribute to others.

Custom packages can be shared as a Zip file with other users, or they can be published to the Package Marketplace.

For more information about creating and maintaining packages, see Creating a Package.

Publishing Packages

In order to publish your package you just have to make it available as a Zip file, and publish the URL. A good place to tell people about your package is Humio's Slack community.

You can also the share the package on a repository service, for example Github, where it can be installed using Command-Line Interface (humioctl) or by downloading the Zip archive of your repository.