Referencing Package Assets

The documentation explains how to properly reference assets from LogScale packages, including parsers and saved searches, when using them across different areas of the system. The format requires specifying the package scope and package name, with specific examples provided for referencing both parser assets (using the format PACKAGESCOPE/PACKAGENAME:PARSERNAME) and saved searches (using the format $PACKAGESCOPE/PACKAGENAME:SEARCHNAME()).

When referring to assets from packages in other areas of LogScale, for example, when referring to a parser when using the Ingesting with HTTP Event Collector (HEC), you must use a set format according to the asset type. The base form includes the package scope (i.e. typically the partner or company name) and packagename as defined in Understanding Package Scopes:

  • Parser

    To refer to a parser within the given repository just the name can be provided. To refer to the parser from a package installed into the repository, use the form PACKAGESCOPE/PACKAGENAME:PARSERNAME. For example, to use the apache_access within the apache/http-server package, use apache/http-server:apache_access.

  • Saved Search

    To refer to a saved search, use package scope and the name of saved search. For example within the Humio Insights package the cpuUsagePercent search used in the dashboard can be referred to using $humio/insights:cpuUsagePercent().