Falcon LogScale Collector

Falcon LogScale Collector is a lightweight, purpose-built agent designed specifically for collecting log data from various sources on endpoints, servers, and containers and forwarding it efficiently to Falcon LogScale Collector. The collector is optimized for LogScale's architecture and provides seamless integration with LogScale features.

The collector supports multiple collection methods including file monitoring, syslog reception, and Windows event log collection. It includes built-in buffering to handle temporary network interruptions and compression to minimize bandwidth usage during data transmission.

Data Flow

The following diagram shows how log data flows through Log Collector's ingestion pipeline when using the Falcon LogScale Collector:

flowchart LR A[Log Files] --> B[LogScale Collector] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[Regex Parser] D --> D2[Key-Value Parser] D --> D3[JSON Parser] D --> D4[Multi-line Parser] D --> D5[Grok Parser] end D1 & D2 & D3 & D4 & D5 --> E[Compression] E --> F[Repository Storage]
flowchart LR A[Log Files] --> B[LogScale Collector] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[Regex Parser] D --> D2[Key-Value Parser] D --> D3[JSON Parser] D --> D4[Multi-line Parser] D --> D5[Grok Parser] end D1 & D2 & D3 & D4 & D5 --> E[Compression] E --> F[Repository Storage]

With its low resource footprint and native LogScale integration, the collector is the recommended choice for most deployment scenarios where you need a reliable, efficient log shipping solution.