CrowdStrike Falcon LogScale

The CrowdStrike Falcon LogScale destination sends logs to a CrowdStrike Falcon LogScale repository. Bindplane delivers telemetry over OTLP/HTTP to the LogScale ingest endpoint, authenticating with a repository ingest token.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• A CrowdStrike Falcon LogScale account with a repository to ingest into.
• An ingest token for the receiving repository.
• The hostname (or IP address) and TCP port of the LogScale host reachable from the collector.

Configuration

General

Parameter	Type	Default	Description
Hostname	String		Hostname or IP address of the LogScale host. Required.
Port	Integer	443	TCP port of the LogScale host. Valid range is 1–65535.
Ingest Token	String		Token used to authenticate when ingesting data into LogScale. Required and sensitive (treated as a secret).

Advanced

Parameter	Type	Default	Description
Drop Raw Copy	Boolean	true	When enabled, drops the raw copy of the log stored in log.record.original.

Retry on Failure

Parameter	Type	Default	Description
Enable Retry on Failure	Boolean	true	Attempt to resend telemetry data that failed to transmit to the destination.
Initial interval	Integer	5	Time (in seconds) to wait after the first failure before retrying. Applies when retry is enabled.
Max interval	Integer	30	The upper bound (in seconds) on backoff. Applies when retry is enabled.
Max elapsed time	Integer	300	Maximum time (in seconds) spent trying to send a batch, used to avoid a never-ending retry loop. Applies when retry is enabled.

Sending Queue

Parameter	Type	Default	Description
Enable Sending Queue	Boolean	true	Buffer telemetry data temporarily before sending to help ensure data is not lost during a temporary network outage.
Number of Consumers	Integer	10	Number of consumers that dequeue batches. Applies when the sending queue is enabled.
Queue Size	Integer	5000	Maximum number of batches kept in memory before dropping. Applies when the sending queue is enabled.
Enable Persistent Queuing	Boolean	true	Buffer telemetry data to disk before sending to help ensure data is not lost during network outages or collector restarts. Applies when the sending queue is enabled.
Persistent Queue Storage	Extension	file_storage_persistent_queue	The storage to use for the persistent queue. Required when both the sending queue and persistent queue are enabled.

Example Configuration

Standalone Destination

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  id: crowdstrike
  name: crowdstrike
spec:
  type: crowdstrike
  parameters:
    - name: hostname
      value: 'cloud.community.humio.com'
    - name: port
      value: '443'
    - name: ingest_token
      value: 'my-ingest-token'
    - name: drop_raw_copy
      value: 'true'

Configuration Tips

Authentication

• The ingest_token is scoped to a single repository. Generate it from the receiving repository's settings in LogScale, not from your user profile. See Ingest tokens.
• The ingest token is sensitive. Bindplane stores it as a secret, and it is sent on the Authorization: Bearer header to the LogScale OTLP ingest endpoint.

Reducing payload size

• Leave drop_raw_copy enabled to drop the raw log.record.original attribute before sending. Disable it only if you need the original raw record preserved in LogScale.

Reliability

• Keep the sending queue and persistent queue enabled so telemetry survives temporary network outages and collector restarts. See Persistent Queue.

Troubleshooting

Symptom: Logs are rejected with an authentication or authorization error. Solution: Confirm the ingest_token belongs to the receiving repository and has not been revoked. Regenerate the token from the repository's ingest token settings if needed.

Symptom: No logs reach LogScale and the collector reports connection failures. Solution: Verify the hostname and port match the LogScale host and that the collector can reach it. LogScale Cloud uses TCP port 443 by default.

Symptom: Logs arrive but are missing the original raw record. Solution: This is expected when drop_raw_copy is enabled. Disable it to retain the log.record.original attribute on each record.

Related Resources

• CrowdStrike Falcon LogScale documentation
• Ingesting data with tokens
• Persistent Queue configuration