Crisp answer: Logscale (formerly Humio) is a high-performance log management and observability platform built for real-time log ingestion and search at scale. Mimecast uses it as their central logging platform. CrowdStrike acquired Humio in 2021 and rebranded it as Falcon LogScale.
What Logscale does:
Ingests: Structured and unstructured logs from any source
(applications, infrastructure, security tools)
Stores: Compressed, indexed for fast search
Searches: Real-time streaming search as logs arrive
Alerts: Trigger on log patterns (e.g. error rate spike, specific event)
Dashboards: Visualise log-derived metrics
Key differentiator vs Elasticsearch/Splunk:
Humio/Logscale was built on a bucketed time-series storage model optimised
for log data specifically:
- Ingest at millions of events per second
- Compress logs 15-25x (stores raw data, not indexes in the traditional sense)
- Search runs against compressed data in parallel
- Much cheaper storage than Elasticsearch at equivalent retention
- Real-time: search includes logs arriving right now
LogScale query language (LQL):
Logscale uses a pipe-based query language:
# Find all errors in the last hour
level=ERROR | count()
# Find slow HTTP requests
http.method=GET http.duration>500 | avg(http.duration) | sort(avg)
# Top 10 error messages
level=ERROR | groupBy(message) | sort(count, limit=10)
# Alert when error rate exceeds threshold
level=ERROR | timechart(span=1m) | where count > 100
# Fields extraction from unstructured logs
/(?P<status>\d{3}) (?P<path>\/\S+)/ | groupBy(status)
How logs get into Logscale:
FluentD / Fluent Bit: Kubernetes log collector → Logscale
Vector: Modern log router, replaces Fluentd in many stacks
Logstash: Part of ELK stack, can forward to Logscale
Direct API: Applications send directly via HTTP API
Elastic Filebeat: Agent that ships log files
In a Kubernetes environment:
Pod logs (stdout/stderr)
→ Fluent Bit DaemonSet (runs on every node)
→ Logscale ingest API
→ Searchable in Logscale UI
Benefits over just kubectl logs:
- Historical: logs from deleted pods are retained
- Correlation: search across all pods and services simultaneously
- Alerting: set up alerts on log patterns
- Audit: immutable log retention for compliance
Logscale vs the alternatives:
| Tool | Strengths | Weaknesses |
|---|---|---|
| Logscale | Fast ingest, cheap storage, real-time | Less ecosystem than ELK, CrowdStrike pricing |
| Elasticsearch | Rich ecosystem, flexible | Expensive at scale, complex to operate |
| Splunk | Enterprise features, mature | Very expensive licensing |
| Loki (Grafana) | Cheap, integrates with Grafana | Query language less powerful |
| CloudWatch Logs | Built into AWS, no setup | Expensive at high volume, limited search |
What to say in the interview:
"Logscale is Mimecast's central log platform. I know it as formerly Humio, acquired by CrowdStrike. Its key advantage over Elasticsearch is the storage model: it stores compressed raw data and searches in parallel rather than maintaining large indexes, which makes it much cheaper per GB of logs at scale. In Kubernetes the standard pattern is a Fluent Bit DaemonSet on every node that ships pod logs to Logscale. I have not used Logscale directly but I have used Loki which follows a similar philosophy, and the LQL query language is a pipe-based model similar to Splunk SPL. I am comfortable picking it up quickly."