Native JSON intake

curl -X POST http://localhost:5080/api/v1/intake/logs/app \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d "[{\"_timestamp\":$(date +%s)000000,\"level\":\"error\",\"msg\":\"db pool exhausted\",\"trace_id\":\"abc123\"}]"

{ "accepted": 1, "rejected": 0, "errors": [] }

curl -X POST http://localhost:5080/api/v1/intake/logs/app \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d "[{\"_timestamp\":$(date +%s)000000,\"level\":\"error\",\"msg\":\"db pool exhausted\",\"trace_id\":\"abc123\"}]"

{ "accepted": 1, "rejected": 0, "errors": [] }

POST /api/v1/intake/{type}/{stream}

Posts one record object or an array of records to a stream. The stream is created on the first write, and the schema evolves as new fields appear. The call requires the permission streams.write. The default intake token and service account tokens with a write role work. Path parameters

Param	Type	Notes
`type`	string	`logs`, `metrics`, or `traces`. Another value answers `404`.
`stream`	string	Stream name with letters, numbers, `_`, `-`, and `.`. The name `_molesignal` is reserved and answers `403`.

Body A JSON object, or an array of JSON objects. Every element must be an object. The request body is limited to 2 MiB and is not decompressed, so do not send Content-Encoding: gzip to this endpoint.

Field	Notes
`_timestamp`	Event time in microseconds since the Unix epoch. When absent, the server receive time applies.
`metric_name`	For `metrics`, the metric the record belongs to. A metrics stream holds the metrics of one source; a record without `metric_name` belongs to the metric named after the stream.
any other field	Stored as a field of the stream. A later record must use the same type as the stream already stores for the field.

curl -X POST http://localhost:5080/api/v1/intake/logs/app \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d "[{\"_timestamp\":$(date +%s)000000,\"level\":\"error\",\"msg\":\"db pool exhausted\",\"trace_id\":\"abc123\"}]"

{ "accepted": 1, "rejected": 0, "errors": [] }

A record that conflicts with the schema is rejected on its own, and the rest of the batch is accepted:

{
  "accepted": 1,
  "rejected": 1,
  "errors": [
    { "index": 0, "reason": "type mismatch on field `level`: expected Utf8, got Number" }
  ]
}

Errors

Status	Cause
`400`	Invalid stream name, invalid JSON, or an array element that is not an object (`event #1 must be a JSON object`).
`401`	Missing or invalid token.
`403`	The token lacks `streams.write`, or the stream is `_molesignal`.
`413`	The body exceeds 2 MiB.
`429`	The router rate limit applies.

Last modified on October 26, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration