Skip to content

Ingest plain-text logs

You will learn how to send unstructured log lines to Cordo without inventing a JSON envelope.

Use this when producers emit one line per event (syslog-style or app stdout) and you do not want collectors to guess structure. For JSON objects or arrays, use Ingest JSON logs instead.

Prerequisites

  1. A stream — Create and manage streams.
  2. A stream API key (lax_…) — Manage stream API keys.

Endpoint

POST /v1/streams/{stream_id}/ingest/text
Content-Type: text/plain
X-API-Key: lax_<prefix>_<secret>

text/plain; charset=utf-8 is fine. This path is separate from /v1/streams/{stream_id}/ingest (JSON only). Invalid JSON on the JSON path is never reinterpreted as text.

What Cordo stores

Each non-empty line becomes:

{"message":"<exact line>"}
  • Split on newlines; CRLF is supported; blank lines are skipped.
  • Body must be valid UTF-8.
  • Budgets: 1 MiB body, 10_000 non-empty lines, 256 KiB per line.
  • If a line is a complete JSON object string, Cordo extracts nested fields under message (same envelope rules as other ingest methods) and keeps the original at message._raw. Plain text stays a string.
  • No grok or free-text parsing. Receipt time is when Cordo accepted the line.

curl

export CORDO_API=https://<your-cordo-host>
export STREAM_ID=<stream-uuid>
export KEY=lax_<prefix>_<secret>

curl -sS -X POST "$CORDO_API/v1/streams/$STREAM_ID/ingest/text" \
  -H "Content-Type: text/plain" \
  -H "X-API-Key: $KEY" \
  --data-binary $'deploy started\ndeploy finished\n'

A 202 response includes accepted (count of non-empty lines stored).

Collectors

Point Vector or Fluent Bit HTTP sinks at /ingest/text with Content-Type: text/plain and a text encoding — see Ingest with Vector and Fluent Bit.

Next