Sources

Sources are the entry points of the pipeline. Each source collects telemetry and places it on typed channels (logs, metrics, or traces) for downstream processors and sinks.

---

otlp — OTLP Receiver

Accepts OpenTelemetry Protocol over gRPC and HTTP. The most common source when applications are already instrumented with OTEL SDKs.

Signals: Logs, Metrics, Traces

sources:
  otlp_in:
    type: otlp
    grpc:
      listen: "0.0.0.0:4317"   # standard OTLP gRPC port
    http:
      listen: "0.0.0.0:4318"   # standard OTLP HTTP port

Option	Default	Description
grpc.listen	0.0.0.0:4317	gRPC listen address
http.listen	0.0.0.0:4318	HTTP listen address

---

hostmetrics — Host Metrics

Collects system metrics from procfs/sysfs. No external dependencies.

Signals: Metrics

sources:
  host_metrics:
    type: hostmetrics
    collection_interval: 15s
    scrapers: [cpu, memory, disk, network, load, processes]

Option	Default	Description
collection_interval	15s	How often to scrape
scrapers	all	Which scrapers to enable

Available scrapers:

Scraper	Metrics produced
cpu	system.cpu.utilization, system.cpu.time
memory	system.memory.usage, system.memory.utilization
disk	system.disk.io, system.disk.operations
network	system.network.io, system.network.errors
load	system.cpu.load_average.1m/5m/15m
processes	system.processes.count, system.processes.created

---

file — File Tail

Tails one or more files with glob support and optional multiline joining.

Signals: Logs

sources:
  app_logs:
    type: file
    include:
      - "/var/log/app/**/*.log"
      - "/var/log/nginx/access.log"
    exclude:
      - "/var/log/app/debug.log"
    multiline:
      mode: halt_before            # or: halt_after, newline
      condition_pattern: '^\d{4}-\d{2}-\d{2}'

Option	Default	Description
include	required	Glob patterns to tail
exclude	[]	Glob patterns to skip
multiline.mode	—	halt_before, halt_after
multiline.condition_pattern	—	Regex marking start/end of multiline blocks

---

syslog — Syslog

Listens for RFC5424 and RFC3164 syslog messages over UDP or TCP.

Signals: Logs

sources:
  syslog_in:
    type: syslog
    listen: "0.0.0.0:514"
    protocol: udp       # or: tcp

Option	Default	Description
listen	0.0.0.0:514	Listen address
protocol	udp	Transport: udp or tcp

Messages that cannot be parsed as RFC5424 are emitted as raw log records at INFO severity.

---

statsd — StatsD

Receives StatsD metrics over UDP. Supports counters, gauges, timers, and sets.

Signals: Metrics

sources:
  statsd_in:
    type: statsd
    listen: "0.0.0.0:8125"
    flush_interval: 10s

Option	Default	Description
listen	0.0.0.0:8125	UDP listen address
flush_interval	10s	How often to emit aggregated metrics

---

prometheus_scrape — Prometheus Scrape

Scrapes Prometheus /metrics endpoints on a configurable interval.

Signals: Metrics

sources:
  prom_scrape:
    type: prometheus_scrape
    targets:
      - "http://localhost:9090/metrics"
      - "http://app:8080/metrics"
    scrape_interval: 30s

Option	Default	Description
targets	required	URLs to scrape
scrape_interval	30s	Scrape cadence

---

journald — systemd Journal

Reads logs from the systemd journal socket. Linux only.

Signals: Logs

sources:
  journal:
    type: journald
    units: ["nginx", "postgres"]   # omit to read all units
    matches:
      PRIORITY: "3"                # syslog priority filter

Option	Default	Description
units	all	Filter by systemd unit name
matches	—	Journal field key-value filters

---

docker_logs — Docker Container Logs

Streams logs from all running Docker containers via the Docker Engine API. Automatically starts tailing new containers and stops on container exit.

Signals: Logs

sources:
  docker:
    type: docker_logs

No additional configuration required. The source reads DOCKER_HOST from the environment (defaults to /var/run/docker.sock).

Each log record includes container.id, container.name, and container.image.name resource attributes. JSON-structured container logs are parsed and promoted to log record attributes.

---

k8s_events — Kubernetes Events

Watches the Kubernetes Events API and emits cluster events as log records.

Signals: Logs

sources:
  k8s_events:
    type: k8s_events
    namespaces: ["default", "production"]   # omit for all namespaces

Option	Default	Description
namespaces	all	Kubernetes namespaces to watch
kubeconfig	in-cluster	Path to kubeconfig file (leave empty when running in-cluster)

---

kafka — Kafka Consumer

Consumes OTLP-encoded messages from Kafka topics.

Signals: Logs, Metrics, Traces

sources:
  kafka_in:
    type: kafka
    brokers: ["kafka:9092"]
    topics:
      logs: "otlp-logs"
      metrics: "otlp-metrics"
      traces: "otlp-traces"
    group_id: "infrasagent"
    encoding: otlp_proto    # or: otlp_json

Option	Default	Description
brokers	required	Kafka broker addresses
topics.logs	—	Topic for log records
topics.metrics	—	Topic for metric data points
topics.traces	—	Topic for trace spans
group_id	infrasagent	Consumer group ID
encoding	otlp_proto	Message encoding: otlp_proto or otlp_json