Ingest
Listen to stdin and send all input to repository <repo>. If
--ingest-token is specified, the repository
associated with that token is used instead.
Use --parser to specify how
LogScale parses incoming data.
--parser takes precedence over any parser associated
with the ingest token.
You can pipe output from another process, for example:
shell
tail -f /var/log/syslog | humioctl ingest --ingest-token=af21... --parser=syslog
Alternatively, use --tail to specify a file to
follow directly.
Usage:
shell
humioctl ingest [flags] <repo>Table: Local flags
| Parameter | Description |
|---|---|
-B, --batch-bytes int | The maximum number of bytes to send in one batch. Default: 1048576. |
-L, --batch-lines int | The maximum number of events to send in one batch. Default: 500. |
-T, --batch-timeout int | The maximum duration in milliseconds to wait before sending an incomplete batch. Default: 100. |
--ingest-buffer-size int | The maximum event size in bytes. Default: 1048576. |
-e, --fail | Stop processing input when sending events fails, after the allowed number of retries. |
-J, --fields-json string | Add the supplied JSON object to each event as structured fields. |
-h, --help | Help for ingest |
-i, --ingest-token string | Use the specified ingest token instead of the API token. The repository associated with the ingest token is used. |
-l, --label string |
Add a @label=<label> field to each event, to help
identify data sent by the CLI when searching.
|
--multiline-begins-with string | Operate in multiline mode. Each multiline event starts with the specified regexp pattern. |
--multiline-continues-with string | Operate in multiline mode. Each multiline event continues with the specified regexp pattern. |
-n, --no-session |
Do not add a @session field to each event. By default,
humioctl adds a @session field with a unique UUID for each
CLI execution.
|
-o, --open | Open a browser with a live tail of the stream. |
-p, --parser string |
Use a specific parser for ingestion. Takes precedence over any parser
associated with the ingest token. Default: default.
|
-q, --quiet | Do not print ingested data to stdout. |
-r, --retries int | The number of retries when sending events fails. Default: 2. |
-f, --tail string | A file to tail instead of listening to stdin. |
-E, --tail-end |
When used with --tail, start from the end of the
file and follow it. Equivalent to tail -f -n0 <file>.
|
Table: Global flags
| Parameter | Description |
|---|---|
-a,--address string | The HTTP address of the Humio cluster. Overrides the value in your config file. |
--ca-certificate-file string | File path to a file containing the CA certificate in PEM format. Overrides the value in your config file. |
-c, --config string |
Config file (default is
$HOME/.humio/config.yaml)
|
--format string | Change output format of commands, if supported. Valid formats: json |
--insecure | By default, all encrypted connections will verify that the hostname in the TLS certificate matches the name from the URL. Set this to true to ignore hostname validation. |
-u, --profile string | Name of the config profile to use |
--proxy-organization string | Commands are executed in the specified organization. |
-t, --token string | The API token to use when talking to Humio. Overrides the value in your config file. |
--token-file string | File path to a file containing the API token. Overrides the value in your config file and the value of --token. |
--unix-socket-proxy string | Path to a unix socket to use as an HTTP proxy. |