HTTP / HTTPS API

HTTP/HTTPS API ingestion provides a direct, flexible method for sending log data and events to Falcon LogScale Collector using standard HTTP POST requests. This approach enables applications, scripts, and services to send data programmatically without requiring a separate log shipper.

LogScale supports multiple API endpoints for different data formats including structured JSON events, unstructured text logs, and the HTTP Event Collector (HEC) API for compatibility with existing Splunk integrations.

Data Flow

The following diagram shows how data sent via HTTP/HTTPS API flows through Log Collector's ingestion pipeline:

flowchart LR A[Applications] --> B[Direct HTTP/HTTPS POST] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[JSON Parser] D --> D2[HEC Parser] D --> D3[Raw Text Parser] D --> D4[Structured Data Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]
flowchart LR A[Applications] --> B[Direct HTTP/HTTPS POST] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[JSON Parser] D --> D2[HEC Parser] D --> D3[Raw Text Parser] D --> D4[Structured Data Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]

The API uses ingest tokens for authentication and supports batch ingestion for improved performance. This makes it ideal for custom integrations, serverless functions, and applications that need to send events directly from code.