Send messages to OpenObserve

Starting with version 4.5.0, AxoSyslog can send messages to OpenObserve using its Logs Ingestion - JSON API. This API accepts multiple records in batch in JSON format.

Prerequisites

• An OpenObserve account for AxoSyslog, or
• a self-hosted OpenObserve deployment.
• To configure AxoSyslog, you’ll need the username, password, the name of your organization, and the name of the OpenObserve stream where you want to send your data.

Minimal configuration:

destination d_openobserve {
  openobserve-log(
    url("http://your-openobserve-endpoint")
    organization("your-organization")
    stream("your-example-stream")
    user("root@example.com")
    password("V2tsn88GhdNTKxaS")
  );
};

Example configuration:

destination d_openobserve {
  openobserve-log(
    url("https://api.openobserve.ai")
    port(443)
    organization("your-organization")
    stream("your-example-stream")
    user("root@example.com")
    password("V2tsn88GhdNTKxaS")
  );
};

This driver is actually a reusable configuration snippet configured to send log messages using the http() driver using a template. You can find the source of this configuration snippet on GitHub.

Options

The following options are specific to the openobserve-log() destination. But since this destination is based on the http() destination, you can use the options of the http() destination as well if needed.

Note: The openobserve-log() destination automatically configures some of these http() destination options as required by the OpenObserve Ingest API.

organization()

Description: The name of the OpenObserve organization where AxoSyslog sends the data.

password()

Description: The password for the username specified in the user() option.

port()

Description: The port number of the server.

record()

Description: A JSON object representing key-value pairs sent to OpenObserve, formatted as AxoSyslog value-pairs. By default, the openobserve-log() destination sends the RFC5424 fields as attributes. If you want to send different fields, override the default content of the record() field.

stream()

Description: The OpenObserve stream where AxoSyslog sends the data, for example, your-example-stream.

user()

Description: The username of the account, for example, root@example.com.

url()

Description: The base URL of the OpenObserve Ingest API. The actual URL is constructed from the base URL and some other options of the destination: url():port()/api/organization()/stream()/_json