InfraSage Agent

infrasagent is a lightweight telemetry collector that can sit at any stage of your observability pipeline: on bare-metal hosts, as a Kubernetes DaemonSet, as a Docker sidecar, or as a central gateway that aggregates from upstream agents.

It collects logs, metrics, and traces from dozens of sources, enriches and transforms them through a composable processor chain, and delivers them to InfraSage, or to any OTLP-compatible backend, over HTTPS.

Why infrasagent?

	infrasagent	OpenTelemetry Collector	Vector
All three signals (L/M/T)	✅	✅	Logs + Metrics only
Native InfraSage sink	✅	❌	❌
Tail-based trace sampling	✅	✅	❌
Host metrics built-in	✅	✅	❌
CEL transform expressions	✅	❌	Remap (VRL)
Single static binary	✅	✅	✅
Hot config reload	✅	✅	✅
Self-observability metrics	✅	✅	✅

Architecture

Data flows through typed channels between stages. Each stage runs independently; backpressure propagates upstream when a sink falls behind.

┌──────────┐    ┌──────────────┐    ┌────────┐    ┌─────────┐
│  Sources │───▶│  Processors  │───▶│ Router │───▶│  Sinks  │
└──────────┘    └──────────────┘    └────────┘    └─────────┘
     │                                                  │
     └──────────── typed channels (Logs/Metrics/Traces) ┘

Admin API: /health  /ready  /metrics  /topology  /reload

Sources listen for or pull telemetry. Processors enrich, filter, batch, and sample it. Sinks deliver it downstream. Routing is declared in YAML: each sink names the sources or processors that feed it. At startup the pipeline engine builds the DAG, checks that the signals are compatible, and wires up the channels.

Supported components

Sources

Name	Signal	Description
otlp	L/M/T	OTLP gRPC + HTTP receiver
hostmetrics	M	CPU, memory, disk, network, load via procfs
file	L	File tail with multiline support
syslog	L	UDP/TCP RFC5424/RFC3164
statsd	M	StatsD UDP listener
prometheus_scrape	M	Prometheus HTTP pull
journald	L	systemd journal socket
docker_logs	L	Docker Engine API log streaming
k8s_events	L	Kubernetes watch API events
kafka	L/M/T	Kafka consumer

Processors

Name	Description
batch	Buffer and flush on time or size
attributes	Add, remove, rename, or hash attributes
filter	Drop or keep records by field conditions
transform	CEL-based field mutations with optional where
sampling	Head-based (probabilistic) + tail-based (trace-complete)
k8s_attributes	Inject pod, node, and namespace metadata
aggregate	Pre-aggregate metrics to reduce cardinality
deduplicate	Fingerprint-based dedup within a rolling window
rate_limit	Token-bucket rate limiting per label set
geoip	MaxMind DB geo-IP enrichment

Sinks

Name	Signal	Description
otlp	L/M/T	OTLP gRPC or HTTP, for InfraSage and any OTLP backend
clickhouse	L/M/T	Native protocol, LZ4, async insert
prometheus_rw	M	Prometheus Remote Write
kafka	L/M/T	Kafka producer
s3	L/M	Parquet (metrics) + NDJSON (logs)
loki	L	Loki push API
elasticsearch	L	Elasticsearch Bulk API
http	L/M/T	Generic webhook / custom endpoint
stdout	L/M/T	Debug output

Deployment modes

In agent mode, infrasagent runs on every host as a DaemonSet or a systemd service. It collects local telemetry and forwards it to InfraSage or to a gateway tier.

In gateway mode, it runs as a central aggregator. It receives OTLP from upstream agents, applies the pipeline logic, and fans out to one or more backends.

Both modes use the same binary; the difference is in the config.