Ingest

Ingest events

Primary ingest endpoint. Accepts single events, JSON arrays, NDJSON streams, or plain text.

No required schema — send any JSON, fields are indexed automatically.
_timestamp auto-assigned if absent. Recognized aliases: timestamp, @timestamp, time, ts, datetime.
_source settable via X-Source header or source/_source field in body.
Events > 1 MB rejected with 413.
Server assigns _id (ULID) to each event.

post/ingest

Headers

X-Sourcestring

Tag events with a source label (e.g., nginx, api-gateway)

X-Format'json' | 'syslog' | 'clf' | 'raw' | 'auto'

Force log format parser. Default auto detects format.

LogEvent required

Any JSON object. No required schema.

LogEvent[] required

{
  "message": "GET /api/users 200 12ms",
  "level": "info",
  "source": "nginx",
  "status": 200
}

All events accepted