> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/destinations/crowdstrike-falcon-logscale.md). # CrowdStrike Falcon LogScale The CrowdStrike Falcon LogScale destination sends logs to a [CrowdStrike Falcon LogScale](https://library.humio.com/falcon-logscale-cloud/) repository. Bindplane delivers telemetry over OTLP/HTTP to the LogScale ingest endpoint, authenticating with a repository ingest token. ### Supported Telemetry Types | Platform | Metrics | Logs | Traces | | -------- | ------- | ---- | ------ | | Linux | | ✓ | | | Windows | | ✓ | | | macOS | | ✓ | | ### Prerequisites * A CrowdStrike Falcon LogScale account with a repository to ingest into. * An [ingest token](https://library.humio.com/falcon-logscale-cloud/ingesting-data-tokens.html#ingesting-data-tokens-generate) for the receiving repository. * The hostname (or IP address) and TCP port of the LogScale host reachable from the collector. ### Configuration
Bindplane docs - CrowdStrike Falcon LogScale - image 1
#### General | Parameter | Type | Default | Description | | ------------ | ------- | ------- | ----------------------------------------------------------------------------------------------------------- | | Hostname | String | | Hostname or IP address of the LogScale host. Required. | | Port | Integer | `443` | TCP port of the LogScale host. Valid range is 1–65535. | | Ingest Token | String | | Token used to authenticate when ingesting data into LogScale. Required and sensitive (treated as a secret). | #### Advanced | Parameter | Type | Default | Description | | ------------- | ------- | ------- | ---------------------------------------------------------------------------- | | Drop Raw Copy | Boolean | `true` | When enabled, drops the raw copy of the log stored in `log.record.original`. | #### Retry on Failure | Parameter | Type | Default | Description | | ----------------------- | ------- | ------- | ------------------------------------------------------------------------------------------------------------------------------- | | Enable Retry on Failure | Boolean | `true` | Attempt to resend telemetry data that failed to transmit to the destination. | | Initial interval | Integer | `5` | Time (in seconds) to wait after the first failure before retrying. Applies when retry is enabled. | | Max interval | Integer | `30` | The upper bound (in seconds) on backoff. Applies when retry is enabled. | | Max elapsed time | Integer | `300` | Maximum time (in seconds) spent trying to send a batch, used to avoid a never-ending retry loop. Applies when retry is enabled. | #### Sending Queue | Parameter | Type | Default | Description | | ------------------------- | --------- | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enable Sending Queue | Boolean | `true` | Buffer telemetry data temporarily before sending to help ensure data is not lost during a temporary network outage. | | Number of Consumers | Integer | `10` | Number of consumers that dequeue batches. Applies when the sending queue is enabled. | | Queue Size | Integer | `5000` | Maximum number of batches kept in memory before dropping. Applies when the sending queue is enabled. | | Enable Persistent Queuing | Boolean | `true` | Buffer telemetry data to disk before sending to help ensure data is not lost during network outages or collector restarts. Applies when the sending queue is enabled. | | Persistent Queue Storage | Extension | `file_storage_persistent_queue` | The storage to use for the persistent queue. Required when both the sending queue and persistent queue are enabled. | ### Example Configuration #### Standalone Destination ```yaml apiVersion: bindplane.observiq.com/v1 kind: Destination metadata: id: crowdstrike name: crowdstrike spec: type: crowdstrike parameters: - name: hostname value: 'cloud.community.humio.com' - name: port value: '443' - name: ingest_token value: 'my-ingest-token' - name: drop_raw_copy value: 'true' ``` ### Configuration Tips #### Authentication * The `ingest_token` is scoped to a single repository. Generate it from the receiving repository's settings in LogScale, not from your user profile. See [Ingest tokens](https://library.humio.com/falcon-logscale-cloud/ingesting-data-tokens.html#ingesting-data-tokens-generate). * The ingest token is sensitive. Bindplane stores it as a secret, and it is sent on the `Authorization: Bearer` header to the LogScale OTLP ingest endpoint. #### Reducing payload size * Leave `drop_raw_copy` enabled to drop the raw `log.record.original` attribute before sending. Disable it only if you need the original raw record preserved in LogScale. #### Reliability * Keep the sending queue and persistent queue enabled so telemetry survives temporary network outages and collector restarts. See [Persistent Queue](https://docs.bindplane.com/configuration/bindplane-otel-collector/persistent-queue). ### Troubleshooting **Symptom:** Logs are rejected with an authentication or authorization error. **Solution:** Confirm the `ingest_token` belongs to the receiving repository and has not been revoked. Regenerate the token from the repository's ingest token settings if needed. **Symptom:** No logs reach LogScale and the collector reports connection failures. **Solution:** Verify the `hostname` and `port` match the LogScale host and that the collector can reach it. LogScale Cloud uses TCP port `443` by default. **Symptom:** Logs arrive but are missing the original raw record. **Solution:** This is expected when `drop_raw_copy` is enabled. Disable it to retain the `log.record.original` attribute on each record. ### Related Resources * [CrowdStrike Falcon LogScale documentation](https://library.humio.com/falcon-logscale-cloud/) * [Ingesting data with tokens](https://library.humio.com/falcon-logscale-cloud/ingesting-data-tokens.html#ingesting-data-tokens-generate) * [Persistent Queue configuration](https://docs.bindplane.com/configuration/bindplane-otel-collector/persistent-queue) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/integrations/destinations/crowdstrike-falcon-logscale.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.