Ingest Listeners are not available on Humio Cloud. You will have to run your own self-hosted Humio cluster to use Ingest Listeners.
Ingest listeners are a way of shipping data to Humio through raw sockets, using either UDP or TCP. Example use cases are
An ingest listener binds a UDP or TCP port on a network interface to a repository with a parser. All data sent to a network port will be parsed before it is inserted into the repository.
While ingest listeners are a useful way to ship data to Humio, consider whether one of the other ingest APIs or a data shipper would be more appropriate for your use case. When using ingest listeners, each port corresponds to a fixed repository-parser pair. If you want many different repositories or parsers, it may be more convenient to use shippers or the ingest API, rather than juggling a large number of listener ports.
Go to the Ingest Listeners subpage in your repository’s settings page to see a list of already-configured ingest listeners. For a new installation this list will be empty.
In the upper right hand corner there’s a button for Creating a New Ingest Listener.
Creating a new ingest listener is all about mapping a port on a network interface through a parser to a repository. Selecting Add Ingest Listener will present you with the following form
The ingest listener needs the following details
tagsaspect of the parser, as the gelf format already has a timestamp specified.
--net=host. This port needs to be exposed through the
To reduce packet loss in bursts of UDP traffic, please increase the maximum allowed receive buffer size for UDP.
Humio will try to increase the buffer to up to 128MB, but will accept whatever the system sets as maximum.
# Get the current limit from the kernel (in bytes) sysctl net.core.rmem_max # Set to 16MB. Decide on a value of (say) 0.5 - 2 seconds worth of inbound UDP packets. sudo sysctl net.core.rmem_max=16777216
Note that this change needs to happen before Humio is started. You probably want it done when the system boots. On Debian (Ubuntu) you can achieve this by creating a file in
/etc/sysctl.d/ with a name such as
raise_rmem_max.conf and the contents