Send data to Falcon LogScale
See the changelog of this Data Sink type here.
Overview
Onum supports integration with Falcon LogScale.
With our Falcon LogScale Data Sink, you can send event data to Falcon LogScale via HTTP or HTTPS. It is an efficient and flexible way to ingest data into Falcon LogScale without the need for intermediary files or complex configurations. Events can be sent in either raw or JSON format.
Falcon LogScale Setup
You'll need to generate an ingest token in your Falcon LogScale instance, which will be required in the Onum setup. Follow these steps to generate the required LogScale ingest token:
Access LogScale, access the Repositories and views tab and select the relevant repository.
Click Ingest > Settings on the side menu and click Ingest tokens.
In the Ingest tokens page, click + Add token to add a token to this repository.
In the New token dialog box, enter a Token name to identify the token. You can optionally set an Assigned parser by selecting a parser from the list. For more information on parsers, see this article.
Click Save.
Learn more about LogScale ingest tokens in this article.
Onum Setup
Access Onum, go to the Data sinks area and click New data sink. Select the Falcon LogScale Data Sink from the list.
Enter a Name for the Data Sink. Optionally, add a Description and some Tags to identify the Sink.
Decide whether or not to include this Data Sink info in the metrics and graphs of the Home area using the Include in metrics toggle.
Enter your Instance URL (check your required URL in this article) and the Port number. Port 443 is required for the Falcon LogScale connection.
Click on the Token field and select New secret. In the window that appears, give your secret a Name and choose if you want to give a Expiration date to your token or not. Then, click Add new value and paste the token that you generated in LogScale (see the Falcon LogScale Setup section above). Click Save when you're done.
Learn more about Secrets in this article.
Now, select the token you have just created in the Token field.
In the Event format section, choose either JSON or Raw.
In the Advanced configuration settings, you can add some additional config.
For optimal performance, we strongly recommend enabling Bulk configuration and enter these settings to significantly improve performance and reduce system load:
Event time limit -
2Number of events -
1500Batch size (bytes) -
5000000
Depending on your Pipelines ingestion level, you may need to adjust these values to optimize performance and prevent prolonged waiting periods that could contribute to back pressure.
Only enable Bulk configuration after completing Pipeline debugging. If you need to use Debug mode, temporarily disable Bulk configuration, then re-enable it once debugging is complete.
Toggle on the Enable retry attempts button if you want to define rules that dictate how the system will automatically re-run failed operations.
Max attempts
Maximum number of attempts before returning an error. The minimum value is 1.
Wait between attempts
The milliseconds to wait between retry attempts. The minimum value is 100.
Backoff interval
A multiplication factor you may apply to the time established in the Wait between attempts parameter to increase the time to wait between attempts. For example, if the Wait between attempts is 100, and the Backoff interval is 2, the retry time will increase as follows each time: 100, 200, 400, 800... The minimum value is 1.
If you are using a proxy to establish the connection, toggle on the Proxy configuration button and enter these details:
Select scheme
Choose the scheme to connect to (HTTP or HTTPS).
Host
The host of the proxy URL used to establish the connection.
Port
The port of the proxy URL used to establish the connection.
Username
This is the username used to access the proxy.
Select password
Choose the proxy passcode from your secrets or create a new one.
Click Finish when complete. Your new Data Sink will appear in the Data sinks area list.
Pipeline configuration
When it comes to using this Data sink in a Pipeline, you must configure the following output parameters. To do it, simply click the Data sink on the canvas and select Configuration.
Output configuration
Message*
Select the field to include in the output message. The data type must be string.
Add fields
Optionally, you may include as many key-value pairs as required.
Field name*
Enter a name for the new field.
Value*
Select the field that contains the value data.
Last updated
Was this helpful?