Data intake

​

Supported protocols

​

Native HTTP JSON

curl -X POST http://localhost:5080/api/v1/intake/logs/app \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '[{"_timestamp":1700000000000000,"level":"error","msg":"db pool exhausted","trace_id":"abc123"}]'

​

OpenTelemetry

exporters:
  otlphttp:
    endpoint: http://localhost:5080/api/v1
    headers:
      authorization: "Bearer ${MS_JWT}"

exporters:
  otlp:
    endpoint: localhost:4317
    headers:
      authorization: "Bearer ${MS_JWT}"

​

Prometheus remote_write

remote_write:
  - url: http://localhost:5080/api/v1/prometheus/api/v1/write
    authorization:
      credentials: "${MS_JWT}"

​

Loki and Elasticsearch

POST /api/v1/loki/api/v1/push
# JSON request shape only; snappy-protobuf is not decoded.

POST /api/v1/_bulk
# Works with Filebeat, Logstash, and the Vector ES sink.

​

Pipeline functions

• VRL — always available. Compiled per (function_id, updated_at) with the vrl::compiler stdlib (del, parse_json, to_int, match, encrypt/decrypt, …).
• JavaScript — opt-in, built on deno_core (V8). JavaScript is available only when the binary is built with --features js-runtime; there is no runtime TOML switch.
• LLM evaluation — API-configurable for low-throughput pipelines when [functions].llm_eval_enabled = true and the organization has an enabled model provider. Each event triggers a model request.

// Lowercase a `severity` field into a new `level` field.
molesignal.set("level", molesignal.fields.severity.toLowerCase());
// Drop a sensitive field.
molesignal.del("pw");