Send logs over HTTP

The NDJSON gateway at /api/ingest/ndjson forwards your request body unchanged to the index your ingest API key is scoped to. Use it to write to a custom-schema index, or when you already emit JSON and don’t want to adopt OpenTelemetry. For OpenTelemetry-instrumented apps, use the OTLP endpoint instead. The gateway does no batching or retries. Use an agent such as Vector, or handle both in your client.

Prerequisites

A running Rootprint instance. Substitute its host for <your-rootprint>.
curl, or a log agent such as Vector.

Setup

Create the index

Create an index with the fields your logs carry and one datetime field as the timestamp. See Create a custom index.The index mode decides what happens to fields the schema doesn’t declare: dynamic stores them, lenient ignores them, and strict rejects the record.

Create an ingest API key

In Settings → API keys, click Create ingest key and pick the index. See API keys.

Send records

Send NDJSON: one JSON object per line, with no wrapping array and no trailing commas. Set Content-Type: application/x-ndjson (application/json also works). The examples write to an audit-log index with the fields ts, level, action, actor, and source_ip.

curl
Vector

Replace <your-rootprint> and <your-ingest-api-key>.

curl -X POST 'https://<your-rootprint>/api/ingest/ndjson' \
  -H 'Authorization: Bearer <your-ingest-api-key>' \
  -H 'Content-Type: application/x-ndjson' \
  --data-binary @- <<EOF
{"ts":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","level":"info","action":"user.login","actor":"alice@acme.io","source_ip":"10.0.0.4"}
{"ts":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","level":"warn","action":"index.delete","actor":"bob@acme.io","source_ip":"10.0.0.9"}
EOF

Add an http sink. Shape events to your index’s fields in a remap transform first. Send syslog has a complete example. Replace <your-transform>, <your-rootprint>, and <your-ingest-api-key>.

sinks:
  rootprint:
    type: http
    inputs: [<your-transform>]
    uri: https://<your-rootprint>/api/ingest/ndjson
    encoding:
      codec: json
    framing:
      method: newline_delimited # one object per line, not a JSON array
    auth:
      strategy: bearer
      token: <your-ingest-api-key>
    batch:
      max_bytes: 8388608
      timeout_secs: 1

For install and systemd setup, see Send logs with Vector.

Map display roles

On the index’s Configuration tab, point Log level and Message at your fields: level and action in this example. The defaults assume the OpenTelemetry schema (severity_text, body.message), so records look blank until you change them.

Verify in Rootprint

A successful POST returns 200 with num_ingested_docs and num_rejected_docs counts. Accepted documents become searchable a few seconds later. Open Logs, pick your index from the selector, and look for the records you sent.

To write to the built-in otel-logs-v0_9 index instead, send records with its field names (see Indexes):

{"timestamp_nanos":1782036240000000000,"severity_text":"INFO","body":{"message":"User logged in"},"service_name":"frontend","attributes":{}}

Troubleshooting

200 with num_rejected_docs above 0: some lines were dropped and the rest were accepted. Common causes: a trailing comma, a JSON array instead of one object per line, a value whose type doesn’t match the index schema, or an undeclared field in a strict index.
401, 403, 413, or 503: see Response codes. The NDJSON gateway returns them for the same reasons.

OTLP reference: for OpenTelemetry apps
Indexes: built-in OpenTelemetry schema
Create a custom index: define your own index schema
Manage indexes: map log level, message, and traceback
POST /api/ingest/ndjson: endpoint reference

Get Started

Send Logs

Traces

Search Logs

Manage Rootprint

Send logs over HTTP

Prerequisites

Setup

Troubleshooting

​Prerequisites

​Setup

​Troubleshooting

​Related

Prerequisites

Setup

Troubleshooting

Related