# Send messages to Falcon LogScale

Starting with version 4.3.0, AxoSyslog can send messages to [Falcon LogScale](<https://library.humio.com/>) using its [Ingest Structured Data API](<https://library.humio.com/integrations/api-ingest.html#api-ingest-structured-data>). That way you don’t have to parse the data on Falcon LogScale, because AxoSyslog already sends it in a structured format that LogScale understands and can show in a structured manner as separate columns. For a tutorial on using this destination in Kubernetes, see the [From syslog-ng to LogScale: structured logs from any source](<https://axoflow.com//blog/from-syslog-ng-to-logscale-structured-logs-from-any-source>) blog post.

## Prerequisites

  * Create an [Ingest token](<https://library.humio.com/falcon-logscale-self-hosted/ingesting-data-tokens.html>) for AxoSyslog to use in the `token()` option of the destination. This token is specific to a LogScale repository.



## Ingest Structured Data API

The `logscale()` destination feeds LogScale via the [Ingest Structured Data API](<https://library.humio.com/integrations/api-ingest.html#api-ingest-structured-data>).

Minimal configuration:
```
 
    @include "scl.conf"
    # ...
    
    destination d_logscale {
      logscale(
        token("your-logscale-ingest-token")
      );
    };
    
```

This driver is actually a reusable configuration snippet configured to send log messages using the `http()` driver using a template. You can find the source of this configuration snippet on [GitHub](<https://github.com/axoflow/axosyslog/blob/master/scl/logscale/logscale.conf>).

## Options

The following options are specific to the `logscale()` destination. But since this destination is based on the `http()` destination, you can use the [options of the `http()` destination](../../docs/axosyslog-core/chapter-destinations/configuring-destinations-http-nonjava/reference-destination-http-nonjava/index.md) as well if needed.

## attributes()

|   
---|---  
Type: | string  
Default: | `"--scope rfc5424 --exclude MESSAGE --exclude DATE --leave-initial-dot"`  
  
_Description:_ A JSON object representing key-value pairs for the LogScale Event, formatted as [AxoSyslog value-pairs](../../docs/axosyslog-core/chapter-concepts/concepts-value-pairs/option-value-pairs/index.md). By default, the `logscale()` destination sends the RFC5424 fields as attributes. If you want to send different fields, override the default template.

## content-type()

|   
---|---  
Type: | string  
Default: | `"application/json"`  
  
_Description:_ The content-type of the HTTP request.

## extra-headers()

|   
---|---  
Type: | string  
Default: |   
  
_Description:_ Extra headers for the HTTP request.

## rawstring()

|   
---|---  
Type: | template  
Default: | `${MESSAGE}`  
  
_Description:_ Accepts a template that you can use to format the [LogScale event](<https://library.humio.com/integrations/api-ingest.html#api-ingest-more-events>).

## timestamp()

|   
---|---  
Type: | template  
Default: | `${S_ISODATE}`  
  
_Description:_ The timestamp added to the [LogScale event](<https://library.humio.com/integrations/api-ingest.html#api-ingest-more-events>).

## timezone()

|   
---|---  
Type: | string  
Default: |   
  
_Description:_ The timezone of the event.

## url()

|   
---|---  
Type: | string  
Default: | `"https://cloud.humio.com"`  
  
_Description:_ The URL of the LogScale Ingest API.

Last modified January 14, 2026: [Fix type keyword in frontmatter (2c54f5f)](<https://github.com/axoflow/axosyslog-core-docs/commit/2c54f5f2b98d4f14096313e9b73f5d169d659346>)