Skip to main content
Every signal enters MoleSignal through the intake API. The Datasource page in the web UI generates the endpoint, token, and configuration snippet for each source. The same protocols can be configured by hand.

Datasource page

Open Datasource to onboard a source:
  1. Search the catalog or filter it by category: Recommended, Infrastructure, Cloud, Databases, Messaging, Apps & languages, Security, and Custom. The signal tabs (Logs, Metrics, Traces, Profiles) narrow the list further.
  2. Select a source such as Kubernetes, a Linux host, AWS, an OpenTelemetry SDK, or Web RUM.
  3. Follow the three steps of the guide:
    • Endpoint and token shows where to send data and the token to authenticate with. Show token reveals the token, with its role, workspace, and expiry. For a RUM source, choose the RUM application first: its client token appears once it is chosen.
    • Set up the source shows commands and configuration with the real endpoint and token already filled in.
    • Verify data is arriving checks the receiver, then looks for data received in the last hour. Verify connection checks at once, and the figures refresh every 30 seconds.
  4. Read the result of the verification:
    • Data detected: data arrived in the last hour, and the signals of the source are healthy. View received data opens the data, and Create pipeline starts a pipeline for it.
    • Receiver is healthy, but data needs attention: the receiver answers, but no data arrived, or not every signal is healthy. Check the deployment, or wait for the next batch.
    • Verification failed: the receiver could not be checked. Possible causes lists a collector that is not running, a token that is invalid or expired, and a network or proxy that blocks the endpoint.
The endpoint comes from http.external_url when it is set, and from the address of the browser otherwise. Set http.external_url behind a reverse proxy so generated snippets point at the public address. See Configuration.

Intake tokens

Senders authenticate with a bearer token: Authorization: Bearer <token>. Use the default intake token or a service account token for senders that run continuously. A login token stops working when it expires and takes down every sender that uses it. Revoke a token from Identity & Access → API tokens to stop it immediately. The Datasource page creates a RUM client token when an application id is entered. An application id contains 1 to 128 characters from A-Z, a-z, 0-9, ., _, :, and -. Use the same id as applicationId in the SDK. See Browser RUM SDK.

Endpoints and protocols

All endpoints except the push connectors require a bearer token with the streams.write permission. The organization comes from the token and never appears in a URL.

Limits that affect senders

  • Request size. A request body larger than 2 MiB is rejected with 413. Keep batches below that size.
  • Compression. OTLP over HTTP does not accept compressed request bodies and answers 400. Disable compression in the sender; the OpenTelemetry Collector otlphttp exporter compresses with gzip by default and needs compression: none. Elasticsearch _bulk, Loki push, and the push connectors accept Content-Encoding: gzip.
  • Loki encoding. Only the JSON request shape is decoded. Promtail and Grafana Alloy send snappy-compressed protobuf by default and cannot send to this endpoint.
  • Rate limit. The router role limits requests per organization and answers 429 with a Retry-After header. A standalone node does not apply this limit. See Role-based deployment.
  • Reserved stream. The stream name _molesignal is reserved for the service’s own telemetry and rejects public intake.

Streams and schema

A stream is created on its first write, and the schema evolves as new fields appear. A stream is identified by its name and signal type, so default can exist for logs, metrics, and traces at the same time. See Streams. Every event has a timestamp in microseconds since the Unix epoch. Native JSON and Elasticsearch _bulk read the _timestamp field. An event without _timestamp receives the time the server accepted it.

Native HTTP JSON

Post an array of records to /api/v1/intake/{logs,metrics,traces}/{stream}:
The response reports how many records were accepted and rejected, with a reason per rejected index:

OpenTelemetry

Point an OpenTelemetry SDK or Collector at the /api base path. The exporter appends /v1/logs, /v1/metrics, and /v1/traces, which map to /api/v1/logs, /api/v1/metrics, and /api/v1/traces.
SDK environment variables:
OpenTelemetry Collector:
Send protobuf (application/x-protobuf), the default encoding of the SDKs and the Collector. Logs, metrics, and traces also accept JSON (application/json). Add a stream-name header to select a stream other than default. The header applies to every signal sent through that exporter.
OTLP metrics are stored as one event per data point. See the metric storage contract for the stored fields.

Prometheus remote_write

Add MoleSignal as a remote write target in prometheus.yml:
A metrics stream holds the metrics of one source, so give each Prometheus server its own stream with the stream-name header (headers: in the remote_write entry); without it, samples go to default. Each sample becomes a row whose metric_name is its __name__. Other labels become fields, and a label named like a metric field, such as metric_name, is kept as exported_<name>. Native histograms and metric metadata are skipped, and exemplars are stored beside the samples.

Elasticsearch bulk

Senders that speak the Elasticsearch bulk protocol work without a Loki or OTLP dependency:
The _index of each action selects the target stream. Without it, the stream-name header applies, and then default.

Loki push

The endpoint accepts the Loki JSON request shape:
Labels become fields, the log line becomes the message field, and the nanosecond timestamp is converted to microseconds. The response is 204. Select the target stream with the stream-name header.

Integration guides

Complete configurations for the OpenTelemetry Collector, Vector, Fluent Bit, Filebeat, Prometheus, and Kubernetes.

Pipelines

Route, normalize, redact, and enrich events as they arrive or on a schedule.

Connectors

Receive Kinesis Firehose, Cloudflare Logpush, and Heroku log drains.

Identity & access

Create service accounts and manage API tokens.
Last modified on October 26, 2026