InfraSage Agent
infrasagent is a lightweight, high-performance telemetry collector that sits at any stage of your observability pipeline — on bare-metal hosts, as a Kubernetes DaemonSet, as a Docker sidecar, or as a centralized gateway aggregating from upstream agents.
It collects logs, metrics, and traces from dozens of sources, enriches and transforms them through a composable processor chain, and delivers them to InfraSage (or any OTLP-compatible backend) over HTTPS.
Why infrasagent?
| infrasagent | OpenTelemetry Collector | Vector | |
|---|---|---|---|
| All three signals (L/M/T) | ✅ | ✅ | Logs + Metrics only |
| Native InfraSage sink | ✅ | ❌ | ❌ |
| Tail-based trace sampling | ✅ | ✅ | ❌ |
| Host metrics built-in | ✅ | ✅ | ❌ |
| CEL transform expressions | ✅ | ❌ | Remap (VRL) |
| Single static binary | ✅ | ✅ | ✅ |
| Hot config reload | ✅ | ✅ | ✅ |
| Self-observability metrics | ✅ | ✅ | ✅ |
Architecture
Data flows through typed channels between stages. Each stage runs independently; backpressure propagates upstream when a sink falls behind.
┌──────────┐ ┌──────────────┐ ┌────────┐ ┌─────────┐
│ Sources │───▶│ Processors │───▶│ Router │───▶│ Sinks │
└──────────┘ └──────────────┘ └────────┘ └─────────┘
│ │
└──────────── typed channels (Logs/Metrics/Traces) ┘
Admin API: /health /ready /metrics /topology /reload
Sources listen for or pull telemetry. Processors enrich, filter, batch, and sample it. Sinks deliver it downstream. Routing is declared in YAML — each sink specifies which sources or processors feed it. The pipeline engine builds the DAG, validates signal compatibility, and wires the channels at startup.
Supported Components
Sources
| Name | Signal | Description |
|---|---|---|
otlp | L/M/T | OTLP gRPC + HTTP receiver |
hostmetrics | M | CPU, memory, disk, network, load via procfs |
file | L | File tail with multiline support |
syslog | L | UDP/TCP RFC5424/RFC3164 |
statsd | M | StatsD UDP listener |
prometheus_scrape | M | Prometheus HTTP pull |
journald | L | systemd journal socket |
docker_logs | L | Docker Engine API log streaming |
k8s_events | L | Kubernetes watch API events |
kafka | L/M/T | Kafka consumer |
Processors
| Name | Description |
|---|---|
batch | Buffer and flush on time or size |
attributes | Add, remove, rename, or hash attributes |
filter | Drop or keep records by field conditions |
transform | CEL-based field mutations with optional where |
sampling | Head-based (probabilistic) + tail-based (trace-complete) |
k8s_attributes | Inject pod, node, and namespace metadata |
aggregate | Pre-aggregate metrics to reduce cardinality |
deduplicate | Fingerprint-based dedup within a rolling window |
rate_limit | Token-bucket rate limiting per label set |
geoip | MaxMind DB geo-IP enrichment |
Sinks
| Name | Signal | Description |
|---|---|---|
otlp | L/M/T | OTLP gRPC or HTTP — InfraSage and any OTLP backend |
clickhouse | L/M/T | Native protocol, LZ4, async insert |
prometheus_rw | M | Prometheus Remote Write |
kafka | L/M/T | Kafka producer |
s3 | L/M | Parquet (metrics) + NDJSON (logs) |
loki | L | Loki push API |
elasticsearch | L | Elasticsearch Bulk API |
http | L/M/T | Generic webhook / custom endpoint |
stdout | L/M/T | Debug output |
Deployment Modes
- Agent — runs on every host as a DaemonSet or systemd service, collecting local telemetry and forwarding to InfraSage or a gateway tier
- Gateway — runs as a central aggregator receiving OTLP from upstream agents, applying pipeline logic, and fan-outing to one or more backends
Both modes use the same binary; the difference is in the config.