Reference Guide

When sending data to LogScale with humioctl, note that humioctl is not a replacement for fully-featured data shippers such as LogScale Collector, Logstash, Filebeat, or Metricbeat. It can, however, be useful for quickly sending logs to LogScale, for example, to examine a local log file or test a parser with sample input.

To stream /var/log/system.log to LogScale:

shell
$ tail -f /var/log/system.log | humioctl ingest -o

or:

shell
$ humioctl ingest -o --tail=/var/log/system.log

Humioctl commands

The main humioctl commands are shown in the following table. Each command optionally has local flags and subcommands.

Table: Humioctl commands

ParameterDescription
actions Manage actions.
aggregate-alerts Manage aggregate alerts
alerts Manage alerts
cluster Manage cluster.
completion Generate the autocompletions script for the specified shell (bash or zsh).
feature-flags Manage feature flags.
files Manage lookup files.
filter-alerts Manage filter alerts.
groups Manage groups.
health Show health information.
help Help about any command.
ingest Send data to LogScale.
ingest-tokens Manage ingest tokens.
license Manage the LogScale license (root only).
packages Manage packages.
parsers Manage parsers.
profiles List and manage configuration profiles.
repos Manage repositories.
scheduled-searches Manage scheduled searches.
scheduled-searches-v2 Manage scheduled searches.
search Search for data.
status Show general status information.
tokens Manage tokens.
users Manage users (root only).
views Manage views.

The global flags can be used by humioctl and commands and subcommands where applicable:

Table: Global flags

ParameterDescription
-a,--address string The HTTP address of the Humio cluster. Overrides the value in your config file.
--ca-certificate-file string File path to a file containing the CA certificate in PEM format. Overrides the value in your config file.
-c, --config string Config file (default is $HOME/.humio/config.yaml)
--format string Change output format of commands, if supported. Valid formats: json
--insecure By default, all encrypted connections will verify that the hostname in the TLS certificate matches the name from the URL. Set this to true to ignore hostname validation.
-u, --profile string Name of the config profile to use
--proxy-organization string Commands are executed in the specified organization.
-t, --token string The API token to use when talking to Humio. Overrides the value in your config file.
--token-file string File path to a file containing the API token. Overrides the value in your config file and the value of --token.
--unix-socket-proxy string Path to a unix socket to use as an HTTP proxy.