Methods for Data Ingest
Falcon LogScale Collector provides you with visibility and insights across your organization's computing environment by centralizing your logs and events in one place. Log Collector is able to provide these insights through flexible data ingest options, which provide a means of collecting logs from a wide range of data sources, such as Kafka, Syslog, or Windows event logs.
The ability to ingest logs and events from many sources provides comprehensive visibility across your entire infrastructure which, in turn, enables faster incident response and troubleshooting.
LogScale's ingest capabilities are designed to handle extremely large data volumes with minimal overhead, allowing you to collect everything without sampling, and while maintaining real-time search performance.
The following table summarizes the popular ingest methods:
| Method | Description |
|---|---|
| Falcon LogScale Collector | Native agent for collecting logs from files, syslog, and Windows events |
| CrowdStream | Built-in ingestion framework for Falcon NextGen SIEM |
| HTTP / HTTPS API | Direct API calls for custom integrations and applications |
| Syslog | Standard protocol for network devices and Unix systems |
| Amazon S3 | Ingest AWS logs from S3 buckets using event notifications |
| Azure Event Hubs | Real-time streaming ingestion from Azure services |
| Google Cloud Logging | Managed logging service for GCP resources |
| Kafka | High-throughput distributed streaming platform |
| SNMP Traps | Network device event notifications |
| Docker Collector | Container-native log collection for Docker |
| Windows Event Collector | Centralized Windows event log collection |
| Database Logs (JDBC) | Direct database connectivity for audit logs |
| Filebeat | Lightweight log shipper from Elastic |
| Logstash | Data processing pipeline with transformation capabilities |
| Fluentd | Open-source unified logging layer |
For detailed implementation instructions for each method, see Popular Ingest Methods.