Datasource page
Open Datasource to onboard a source:- Search the catalog or filter it by category: Recommended, Infrastructure, Cloud, Databases, Messaging, Apps & languages, Security, and Custom. The signal tabs (Logs, Metrics, Traces, Profiles) narrow the list further.
- Select a source such as Kubernetes, a Linux host, AWS, an OpenTelemetry SDK, or Web RUM.
- Follow the three steps of the guide:
- Endpoint and token shows where to send data and the token to authenticate with. Show token reveals the token, with its role, workspace, and expiry. For a RUM source, choose the RUM application first: its client token appears once it is chosen.
- Set up the source shows commands and configuration with the real endpoint and token already filled in.
- Verify data is arriving checks the receiver, then looks for data received in the last hour. Verify connection checks at once, and the figures refresh every 30 seconds.
- Read the result of the verification:
- Data detected: data arrived in the last hour, and the signals of the source are healthy. View received data opens the data, and Create pipeline starts a pipeline for it.
- Receiver is healthy, but data needs attention: the receiver answers, but no data arrived, or not every signal is healthy. Check the deployment, or wait for the next batch.
- Verification failed: the receiver could not be checked. Possible causes lists a collector that is not running, a token that is invalid or expired, and a network or proxy that blocks the endpoint.
http.external_url when it is set, and from the address of the browser otherwise. Set http.external_url behind a reverse proxy so generated snippets point at the public address. See Configuration.
Intake tokens
Senders authenticate with a bearer token:Authorization: Bearer <token>.
Use the default intake token or a service account token for senders that run continuously. A login token stops working when it expires and takes down every sender that uses it. Revoke a token from Identity & Access → API tokens to stop it immediately.
The Datasource page creates a RUM client token when an application id is entered. An application id contains 1 to 128 characters from
A-Z, a-z, 0-9, ., _, :, and -. Use the same id as applicationId in the SDK. See Browser RUM SDK.
Endpoints and protocols
All endpoints except the push connectors require a bearer token with the
streams.write permission. The organization comes from the token and never appears in a URL.
Limits that affect senders
- Request size. A request body larger than 2 MiB is rejected with
413. Keep batches below that size. - Compression. OTLP over HTTP does not accept compressed request bodies and answers
400. Disable compression in the sender; the OpenTelemetry Collectorotlphttpexporter compresses with gzip by default and needscompression: none. Elasticsearch_bulk, Loki push, and the push connectors acceptContent-Encoding: gzip. - Loki encoding. Only the JSON request shape is decoded. Promtail and Grafana Alloy send snappy-compressed protobuf by default and cannot send to this endpoint.
- Rate limit. The
routerrole limits requests per organization and answers429with aRetry-Afterheader. Astandalonenode does not apply this limit. See Role-based deployment. - Reserved stream. The stream name
_molesignalis reserved for the service’s own telemetry and rejects public intake.
Streams and schema
A stream is created on its first write, and the schema evolves as new fields appear. A stream is identified by its name and signal type, sodefault can exist for logs, metrics, and traces at the same time. See Streams.
Every event has a timestamp in microseconds since the Unix epoch. Native JSON and Elasticsearch _bulk read the _timestamp field. An event without _timestamp receives the time the server accepted it.
Native HTTP JSON
Post an array of records to/api/v1/intake/{logs,metrics,traces}/{stream}:
OpenTelemetry
Point an OpenTelemetry SDK or Collector at the/api base path. The exporter appends /v1/logs, /v1/metrics, and /v1/traces, which map to /api/v1/logs, /api/v1/metrics, and /api/v1/traces.
- OTLP over HTTP
- OTLP over gRPC
SDK environment variables:OpenTelemetry Collector:Send protobuf (
application/x-protobuf), the default encoding of the SDKs and the Collector. Logs, metrics, and traces also accept JSON (application/json). Add a stream-name header to select a stream other than default. The header applies to every signal sent through that exporter.Prometheus remote_write
Add MoleSignal as a remote write target inprometheus.yml:
stream-name header (headers: in the remote_write entry); without it, samples go to default. Each sample becomes a row whose metric_name is its __name__. Other labels become fields, and a label named like a metric field, such as metric_name, is kept as exported_<name>. Native histograms and metric metadata are skipped, and exemplars are stored beside the samples.
Elasticsearch bulk
Senders that speak the Elasticsearch bulk protocol work without a Loki or OTLP dependency:_index of each action selects the target stream. Without it, the stream-name header applies, and then default.
Loki push
The endpoint accepts the Loki JSON request shape:message field, and the nanosecond timestamp is converted to microseconds. The response is 204. Select the target stream with the stream-name header.
Related pages
Integration guides
Complete configurations for the OpenTelemetry Collector, Vector, Fluent Bit, Filebeat, Prometheus, and Kubernetes.
Pipelines
Route, normalize, redact, and enrich events as they arrive or on a schedule.
Connectors
Receive Kinesis Firehose, Cloudflare Logpush, and Heroku log drains.
Identity & access
Create service accounts and manage API tokens.