> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data intake

> Native and protocol-compatible intake for OpenTelemetry, Prometheus, logs, cloud senders, and application events.

MoleSignal supports native and protocol-compatible intake, so many existing agents and SDKs can
send data with little or no adaptation. Every endpoint is authenticated with
`Authorization: Bearer <jwt>` (or an API token
— see [Security](/en-US/security)), except the push [connectors](/en-US/connectors), which use a
connector token.

## Supported protocols

| Protocol                 | Endpoint                                   | Compatible sender                                 |
| ------------------------ | ------------------------------------------ | ------------------------------------------------- |
| OTLP gRPC                | `:4317`                                    | OpenTelemetry SDK / Collector                     |
| OTLP HTTP                | `POST /api/v1/logs`, `/metrics`, `/traces` | OTel HTTP exporter                                |
| Prometheus remote\_write | `POST /api/v1/prometheus/api/v1/write`     | Prometheus / VictoriaMetrics                      |
| Elasticsearch `_bulk`    | `POST /api/v1/_bulk`                       | Filebeat, Vector ES sink, Logstash                |
| Loki JSON push           | `POST /api/v1/loki/api/v1/push`            | Clients that can send the Loki JSON request shape |
| Kinesis Firehose         | `POST /api/v1/_kinesis_firehose`           | AWS Firehose                                      |
| Cloudflare Logpush       | `POST /api/v1/_cloudflare`                 | Cloudflare Logpush                                |
| Heroku log drain         | `POST /api/v1/_heroku`                     | Heroku                                            |
| Native HTTP JSON         | `POST /api/v1/intake/{type}/{stream}`      | curl / app SDK                                    |

<Note>
  Kinesis Firehose, Cloudflare Logpush, and Heroku log drains are configured per source — see the
  [Connectors](/en-US/connectors) guide.
</Note>

## Native HTTP JSON

The simplest path. POST an array of records to `intake/{logs,metrics,traces}/{stream}`. Timestamps
are microseconds since the Unix epoch, in the `_timestamp` field.

```bash theme={null}
curl -X POST http://localhost:5080/api/v1/intake/logs/app \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '[{"_timestamp":1700000000000000,"level":"error","msg":"db pool exhausted","trace_id":"abc123"}]'
```

The stream is created on first write, and the schema evolves as new fields appear.

## OpenTelemetry

<Tabs>
  <Tab title="OTLP HTTP">
    Point the OTel HTTP exporter at MoleSignal:

    ```yaml theme={null}
    exporters:
      otlphttp:
        endpoint: http://localhost:5080/api/v1
        headers:
          authorization: "Bearer ${MS_JWT}"
    ```

    Logs, metrics, and traces post to `/api/v1/logs`, `/api/v1/metrics`, and `/api/v1/traces`.
  </Tab>

  <Tab title="OTLP gRPC">
    The external standard OTLP gRPC receiver listens on port `4317` by default:

    ```yaml theme={null}
    exporters:
      otlp:
        endpoint: localhost:4317
        headers:
          authorization: "Bearer ${MS_JWT}"
    ```

    Port `5082` is reserved for trusted internal cluster gRPC and must not be used as the public
    OTLP endpoint.
  </Tab>
</Tabs>

## Prometheus remote\_write

Add MoleSignal as a remote write target in `prometheus.yml`:

```yaml theme={null}
remote_write:
  - url: http://localhost:5080/api/v1/prometheus/api/v1/write
    authorization:
      credentials: "${MS_JWT}"
```

## Loki and Elasticsearch

<CodeGroup>
  ```text Loki push theme={null}
  POST /api/v1/loki/api/v1/push
  # JSON request shape only; snappy-protobuf is not decoded.
  ```

  ```text Elasticsearch _bulk theme={null}
  POST /api/v1/_bulk
  # Works with Filebeat, Logstash, and the Vector ES sink.
  ```
</CodeGroup>

The Loki endpoint accepts `{"streams":[{"stream":{...},"values":[["<unix_nano>","<line>"]]}]}`.
Set `stream-name` to choose the MoleSignal log stream. Configure senders for JSON rather than the
default Loki snappy-protobuf encoding.

## Pipeline functions

**Pipeline functions** transform events on the intake hot path through reusable transforms attached
to a pipeline step. The runtime supports:

* **VRL** — always available. Compiled per `(function_id, updated_at)` with the `vrl::compiler`
  stdlib (`del`, `parse_json`, `to_int`, `match`, `encrypt`/`decrypt`, …).
* **JavaScript** — opt-in, built on `deno_core` (V8). JavaScript is available only when the binary
  is built with `--features js-runtime`; there is no runtime TOML switch.
* **LLM evaluation** — API-configurable for low-throughput pipelines when
  `[functions].llm_eval_enabled = true` and the organization has an enabled model provider. Each
  event triggers a model request.

<Warning>
  The JS isolate is deliberately minimal: no `fetch`, no `setTimeout`, no `import`, no `npm`. Each
  event gets a 50 ms wall-clock budget and a 32 MiB heap. Anything beyond a single synchronous pass
  is unsupported by design.
</Warning>

```js theme={null}
// Lowercase a `severity` field into a new `level` field.
molesignal.set("level", molesignal.fields.severity.toLowerCase());
// Drop a sensitive field.
molesignal.del("pw");
```