A query within the correlate() function that enriches constellations with additional aggregated data—such as counts, sums, or other aggregate values—without affecting whether constellations are found. Aggregation queries run after LogScale identifies a valid constellation. They compute additional values based on events that match their filters and constraints. If an aggregation query matches zero events, the constellation is still emitted. Aggregation queries are distinct from mandatory queries, which define the core pattern required for a constellation to exist.

Process of ingesting historical data into LogScale, with specific guidelines for managing large volumes of historical data efficiently.

Lightweight data shippers from Elastic (Filebeat, Metricbeat, Winlogbeat). LogScale supports ingesting data from Beats agents through the Elastic Bulk API compatibility layer.

Pre-configured parsers (accesslog, json, syslog, csv, etc.) provided by LogScale for common log formats.

An index or segment within a LogScale repository that contains related data. Data sources are created automatically as data is ingested and can be tagged for organization and filtering. They represent logical groupings of data that can be managed independently for retention, access control, and performance optimization.

An HTTP API protocol compatible with Elasticsearch's bulk ingest format. LogScale provides Elastic Bulk API endpoints to simplify migration from Elasticsearch or integrate with tools that support this protocol.

Single set of fields, originally extracted from a single line of a log file (raw data). An individual event forms the part of any event stream within the LogScale querying system.

A key-value pair extracted from log data that represents a specific attribute or piece of information within a log event.

A widely-supported HTTP API protocol for sending events to LogScale. Originally designed for data migration, HEC is supported by many log shippers and applications. LogScale provides HEC-compatible endpoints for easy integration.

The volume of data being ingested per unit time, typically measured in GB/day or events/second. Understanding your ingest rate is critical for capacity planning and licensing.

Authentication tokens used for secure data ingestion into LogScale repositories.

A pre-built connection or configuration that enables LogScale to work with external systems, applications, or data sources. Integrations can include log shippers, security tools, cloud services, monitoring systems, and notification platforms. LogScale provides numerous out-of-the-box integrations to simplify data collection and workflow automation.

A software agent or tool that collects log data from systems and forwards it to LogScale. Log shippers can be lightweight agents installed on servers, containers, or network devices. Popular log shippers include Filebeat, Fluentd, the LogScale Collector, and custom applications using LogScale APIs.

CrowdStrike's lightweight agent for collecting and forwarding logs to LogScale. Falcon LogScale Collector can tail files, collect Windows events, run commands, and enrich data before forwarding. It is the recommended collection agent for most use cases.

Files stored in a LogScale repository that contain reference data, such as CSV or JSON files mapping field values to additional information. You can use lookup files with the match() function to enrich events during queries, or reference them in parsers to enrich events at ingest time. LogScale supports uploading and managing lookup files through the repository Files page.

A reference dataset used to enrich events with additional information during querying. Lookup tables can contain mappings like IP addresses to geographic locations, user IDs to names, or error codes to descriptions. They enable data enrichment and correlation without modifying the original log data.

A query within the correlate() function that defines the pattern required for a constellation to exist. All mandatory queries must match events for LogScale to identify a constellation. Mandatory queries establish the core pattern that LogScale searches for—for example, a login event followed by a purchase event from the same user. If any mandatory query in the pattern does not find a match, no constellation is created. Mandatory queries are distinct from aggregation queries, which enrich existing constellations but do not affect whether constellations are found.

Additional information about events or data that provides context but isn't part of the original log message. Metadata can include source information, parsing details, enrichment data, or system-generated fields. LogScale automatically adds metadata during ingestion and allows custom metadata through parsers and enrichment processes.

System-generated fields prefixed with @ (e.g., @timestamp, @rawstring, @id) in LogScale events.

A pre-built bundle of parsers, dashboards, alerts, and saved queries for a specific data source or use case.

A configuration that defines how to extract structured data from raw log entries. Parsers use regular expressions, built-in functions, or structured formats (JSON, XML, CSV) to identify and extract field values from incoming data. Good parsers are essential for making data searchable and meaningful in LogScale.

The mechanism that determines which parser processes incoming events. Parsers can be assigned via ingest token defaults, or LogScale can automatically select parsers based on pattern matching against the raw log text.

An integrated editing environment in the LogScale web interface for writing and testing parser scripts. The Parser Editor displays the parser script on the left panel and test cases on the right panel, allowing you to run tests against sample log events and inspect the resulting parsed fields.

The capability to process and analyze data as it arrives, with minimal delay between data ingestion and availability for searching. LogScale's real-time processing enables live monitoring, immediate alerting, and up-to-the-second dashboards. This is crucial for operational monitoring and incident response.

Organized collection of data where LogScale stores different sources of data such as events, system logs and metrics.

A standard protocol for sending log messages over UDP or TCP. LogScale can receive syslog data directly and parse it using built-in or custom parsers. Syslog is commonly used for network devices, firewalls, and Unix systems.

A label or marker applied to events, data sources, or repositories for organization and filtering purposes. Tags help categorize data and can be used in queries to focus on specific subsets. Tags can be applied during parsing, through enrichment processes, or manually for organizational purposes.

The @timestamp field is created by LogScale when ingesting data, and represents the timestamp of the original event.

A virtual representation that combines data from one or more repositories with optional filtering and access controls. Views enable searching across multiple repositories, restricting access to specific data subsets, or providing simplified interfaces for specific user groups. Views don't store data themselves but provide alternative ways to access repository data.