Install and configure Falcon LogScale Collector

Installing the LogScale collector

The LogScale collector must be installed on the host where Nextcloud writes its log files. For information on installing the LogScale collector on Linux hosts, see: https://library.humio.com/falcon-logscale/log-shippers-log-collector-install-linux.html

LogScale collector configuration file

A configuration file for the LogScale collector to collect Nextcloud logs could look as follows:

sources:
  nextcloud_logs:
    parser: nextcloud/nextcloud:nextcloud
    type: file
    include: /path/to/*.log
    exclude: /path/to/updater.log
    sink: logscale
sinks:
  logscale:
    type: humio
    token: <ingest-token>
    url: <ingest-url>

Parameters to change in the LogScale collector configuration file

include and exclude

Set the path to where the Nextcloud logs are located

token

• Within the repository where you want Nextcloud events to be ingested, click on "Settings"
• In the left-hand menu, click on "Ingest tokens"
• In the "Tokens" table, click on the eye for the token named "default"
• Copy the token value and add it to the collector config file

url

If you are using the Falcon LogScale Community edition, the url will be: https://cloud.community.humio.com
Add it to the collector config file