The humio Repository

The humio Repository is a system repository that holds debug logs generated by LogScale internally. It also has a few built-in dashboards to help you quickly ascertain the state of your LogScale cluster or server.

LogScale logging types are listed below with the names of their respective log files, whether they are for cloud or self-hosted environments, and in which repositories they are available. All of the logs are available in the humio Repository, so they have #type=humio. They will also have a #kind tag for each that corresponds to the log type column in the table below. The humio Repository contains the following #kind events:

Table:

Log type Log file Cloud Self-hosted Description Repository available
logs humio-debug.log No Yes humio debug logs. Not available on Cloud. See humio
activity humio-activity.log No Yes Logs of relevant user activity. For self-hosted. See humio-activity or humio
activity humio-activity.log Yes No Logs of relevant user activity. For Cloud. humio-organization-activity
usage humio-usage.log No Yes Logs of aggregated measurements data. For self-hosted. humio-usage
metrics humio-metrics.log No Yes Contains a broad variety of metrics from internal LogScale runtime for Self-Hosted. See humio-metrics or humio
metrics humio-metrics.log Yes No Contains a broad variety of metrics from internal LogScale runtime for Cloud. humio-organization-metrics
requests humio-requests.log No Yes All HTTP requests. Like an accesslog in LogScale's own format. See humio
nonsensitive humio-non-sensitive.log No Yes Selected log lines where no searches or user data will be present. This can be shipped to LogScale support or other parties. See humio
threaddumps humio-threaddumps.log No Yes LogScale's regular log threaddumps. See humio

The above logs are automatically rotated by LogScale when they reach 50 megabytes in size. LogScale retains up to five files of each.

All of the above logs are available to search in the humio repository. When searching LogScale logs in the humio repository, the tag #type, #kind, and #vhost can be used.

For those logs which are available in other repositories, you can see information about the logs and their fields in their respective chapters.

For more information about logging LogScale to LogScale, see LogScale Internal Logging

Each #kind has fields associated with it.

Humio Repository log examples

The following contains examples of logs from the humio repository.

Activity event example

An example of an activity event is for a trigger. So the information contained in the event is relevant for trigger execution.

Field Value
#kind Activity
#repo humio
#type humio
#vhost 8
@host example.testing:8080
@id XQP9NSlmxlxz6nHCuvRFgiDQ_113_111_1684918557
@ingesttimestamp 1731981792574
@timestamp 1731981792574
@timestamp.nanos 0
@timezone Z
category ScheduledSearch
dataspace humio
externalQueryId P1-q4u0GQwR6Xel6XKT1HAMv8Ts
message Scheduled search found no results and will not trigger
plannedExecutionTime 1731981780000
queryFinishedTime 1731981792573
queryIntervalEndTime 1731981780000
queryIntervalStartTime 1731376980000
scheduledSearchId ipIXwhHy1a1MrBqujswy3OITZkLUpO0k
scheduledSearchName FLTR aidmaster Generation
severity Info
source console.log
status Success
subCategory Query
timestamp 1731981792574
viewId KFrfTEli7ziKVdJiHMzmy6AV

The @rawstring contains the raw event log data that has been parsed into the fields.

Logs event example

Logs events contain LogScale's own logs so the event information is relevant to these types of logs, such as thread, loglevel, and exception.

Field Value
#kind logs
#repo humio
#type humio
#vhost 9
@host example.testing:8080
@id T3PaSn7CE245lnoBvLnKD53I_1574_489_1732019470
@ingesttimestamp 1732019470846
@timestamp 1732019470845
@timestamp.nanos 0
@timezone Z
class c.h.s.e.QueryEndpoint
dataspace humio
exception org.apache.pekko.stream.StreamTcpException:
hostId 2
loglevel WARN
query #kind
source console.log
thread humio-pekko.actor.default-dispatcher-8
viewId nrWby53THW3pSm7RAzWXTs4y

The @rawstring contains the raw event log data that has been parsed into the fields.

Threaddumps event example

A threaddump event captures information about system performance. These events can be useful when troubleshooting system performance or optimization issues.

Field Value
#kind threaddumps
#repo humio
#type humio
#vhost 9
@host example.testing:8080
@id xodbp9Lf4BC8Xcdz07LIMhRv_645_127_1732018811
@ingesttimestamp 1732018811599
@timestamp 1732018811592
@timestamp.nanos 0
@timezone Z
dumpedAt 1732018811578
dumpInterval 10000
group segment-merger
humioClass com.humio.util.ExecutorsUtil$HumioThreadFactory
humioFunction idleWaitInThreadPool$1
humioLine app//com.humio.util.ExecutorsUtil$HumioThreadFactory.idleWaitInThreadPool$1(ExecutorsUtil.scala:95)
humioLineNo 95
name segment-merger-0
source console.log
state WAITING
tid 307

The @rawstring contains the raw event log data that has been parsed into the fields.

Non-sensitive event example

Non-sensitive events show selected log lines where no searches or user data will be present.

Field Value
#kind nonsensitive
#repo humio
#type humio
#vhost 9
@host example.testing:8080
@id 3U0GkIoAVPacOWHI6vhjwLkN_44_33_1732019115
@ingesttimestamp 1732019115518
@timestamp 1732019115518
@timestamp.nanos 0
@timezone Z
device eth0
name netdev
rx_bytes 5715748266
rx_compressed 0
rx_drop 0
rx_errs 0
rx_fifo 0
rx_frame 0
rx_multicast 0
rx_packets 4767385
source console.log
tx_bytes 4337916381
tx_carrier 0
tx_colls 0
tx_compressed 0
tx_drop 0
tx_errs 0
tx_fifo 0
tx_packets 3608874

The @rawstring contains the raw event log data that has been parsed into the fields.

Requests event example

A requests events show all HTTP requests, similar to an accesslog in LogScale's own format.

Field Value
#kind requests
#repo humio
#type humio
#vhost 9
@host example.testing:8080
@id a5MyAtLBaWXToRAQG0hSpVhV_14_250_1732008410
@ingesttimestamp 1732008410584
@timestamp 1732008410584
@timestamp.nanos 0
@timezone Z
connectionSource 10.244.6.1:55464
contentLength 0
decodedContentLength 0
internal false
method GET
remote 10.244.6.1:55464
responseLength 0
route humio
source console.log
status 200
time 0
uri http://10.244.6.72:8080/api/v1/is-node-up
userAgent kube-probe/1.20

The @rawstring contains the raw event log data that has been parsed into the fields.

Metrics event example

A metrics event is also shown in the humio-metrics Repository for self-hosted or humio-organization-metrics Repository for Cloud.

Field Value
#kind metrics
#repo humio
#type humio
#vhost 9
@host example.testing:8080
@id AfBZBFb7QXJhxe78wWvcV2x9_104_1195_1732010069
@ingesttimestamp 1732010069740
@timestamp 1732010069686
@timestamp.nanos 0
@timezone Z
count 0
duration_unit milliseconds
m1 0.0
m15 0.0
m5 0.0
max 0.0
mean 0.0
mean_rate 0.0
median 0.0
metric_type TIMER
min 0.0
name serialize-state-time
p75 0.0
p95 0.0
p98 0.0
p99 0.0
p999 0.0
rate_unit events/second
source console.log
stddev 0.0

The @rawstring contains the raw event log data that has been parsed into the fields. Note that some of the fields shown here are described in The humio-metrics Repository.