Share, discover, and version LogScale queries, parsers, dashboards, and how-tos with the community.
Recently shared by the community.
#windows.Channel = * | groupBy([@collect.host, #windows.Channel])
An overview of Windows systems grouped by Event Log channel. Used in the how-to: [[howto:Install LogScale Collector on Windows]]
@sebastian · 3.8.2026
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757]) | day := formatTime(format="%Y-%m-%d", field=@timestamp, timezone="Europe/Berlin") | rename(field="windows.EventData.TargetUserName", as="group") | groupBy([day, group], function=count())
Aggregate Active Directory group membership additions and removals into a daily count by group for compliance reporting and anomaly baselining. Keep the timezone aligned with your investigation queries. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757]) | windows.EventData.SubjectUserName=/^(svc_|sa_|srv_)/i // only show during office hours, when automation should be idle
Find group membership changes made by service accounts during the period when their automation should be idle. Adapt the account-name regex, office-hour window, and IANA timezone to match your conventions. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
Recently shared ingest parsers.
name: unifi description: >- universal envelope for UniFi Syslog events. Maps Facility/Severity from the Syslog PRI (using in(priority, values=[...]), not arithmetic functions:
Parses UniFi Syslog from Dream Machine, access points, and switches into structured fields for Wi-Fi, DHCP, DNS, gateway, and audit analysis. Set up the export first: [[howto:Forward UniFi Syslog to a Remote Server]]. Dashboards using this parser: [[dashboard:UniFi Basics]], [[dashboard:UniFi Security & Audit]], [[dashboard:UniFi Wi-Fi Quality]], and [[dashboard:UniFi Gateway Health]].
@sebastian · 10.8.2026
Recently shared dashboard definitions.
name: UniFi Security & Audit
updateFrequency: never
description: Security events, privileged commands, and high-severity UniFi Syslog.
timeSelector: {}
Surfaces Syslog severity, privileged commands, firewall blocks, detected threats, and high-severity processes for UniFi review. Prerequisite: [[parser:UniFi Syslog Parser]]. Setup: [[howto:Forward UniFi Syslog to a Remote Server]].
@sebastian · 10.8.2026
name: UniFi Wi-Fi Quality
updateFrequency: never
description: Wi-Fi health, anomalies, RRM scans, and roaming from UniFi Syslog.
timeSelector: {}
Monitors Wi-Fi satisfaction, radio anomalies, RRM scans, and client roaming to help identify unstable coverage and AP behavior. Prerequisite: [[parser:UniFi Syslog Parser]]. Setup: [[howto:Forward UniFi Syslog to a Remote Server]].
@sebastian · 10.8.2026
name: UniFi Gateway Health
updateFrequency: never
description: 'Dream Machine health: memory, services, and DPI errors.'
timeSelector: {}
Tracks Dream Machine memory, UDAPI service levels, DPI warnings, MQ Broker activity, and failed systemd services for health monitoring. Prerequisite: [[parser:UniFi Syslog Parser]]. Setup: [[howto:Forward UniFi Syslog to a Remote Server]].
@sebastian · 10.8.2026
Recently shared guides and walkthroughs.
Configure UniFi Network to export selected system logs as CEF to a remote syslog or SIEM server, then verify that the receiver gets usable events.
@sebastian · 10.8.2026
Run LogScale Collector as a syslog server, map separate listeners to repository-specific ingest tokens, and understand source settings that control delivery.
@sebastian · 10.8.2026
Learn when LogScale repositories define real data boundaries and when views provide the right scoped search workspace without copying data.
@sebastian · 10.8.2026