LogScale Queries

Help

Short answers for new contributors. Jump to a topic or read top to bottom.

What can I upload?

  • Queries — CQL for LogScale / NG-SIEM
  • Parsers — ingest / field extraction configs
  • Dashboards — layout JSON
  • How-tos — guides you can read; publishing is admin-only (see below)

Account levels & limits

  1. Verify email after register — required before any upload.
  2. Registered accounts may publish up to 15 queries, parsers, or dashboards (combined). How-tos do not count toward this limit.
  3. Approved — an administrator can approve your account for unlimited uploads after you hit the limit (or earlier).

Your first upload

  1. Create an account and verify your email.
  2. Open Upload for the content type (footer or browse empty state).
  3. Fill title, description, tags (and category for queries), then the content body.
  4. Publish. Your item appears on the public browse page when published.

Formatting

Descriptions are plain text (wiki links allowed). How-to bodies use Markdown in the editor.

  • # Heading / ## Subheading
  • - list item
  • `inline code` or fenced code blocks
  • Images: use the editor image control (paste/upload)

Linking content

In descriptions (and how-to Markdown), link other pages with wiki syntax:

  • [[query:Exact Title]]
  • [[parser:Name]]
  • [[dashboard:Name]]
  • [[howto:Title]]
  • [[category:Security]]
  • [[user:username]]

Match published titles (case-insensitive). Prefer unique titles so the right page resolves.

Versioning

By default each save creates a new version. Overwrites update the current version in place. Older versions stay in the version history on the detail page.

How-tos

How-tos are published by administrators. Everyone can browse and read them; community uploads are queries, parsers, and dashboards.