Skip to content

Ingest with Vector and Fluent Bit

You will learn how to point Vector or Fluent Bit at Cordo.

These collectors already speak HTTP JSON, OpenSearch bulk, or OTLP — there is no native Cordo plugin. Create a stream API key first: Manage stream API keys.

Vector → HTTP JSON

[sinks.cordo]
type = "http"
inputs = ["your_source"]
uri = "https://<your-cordo-host>/v1/streams/<stream-uuid>/ingest"
method = "post"
encoding.codec = "json"
[sinks.cordo.headers]
X-API-Key = "lax_<prefix>_<secret>"
Content-Type = "application/json"

One JSON object per request works for simple setups. For batches, emit a JSON array or use the Elasticsearch sink against _bulk instead.

Vector → HTTP plain text

For newline-delimited unstructured lines (no JSON codec):

[sinks.cordo_text]
type = "http"
inputs = ["your_source"]
uri = "https://<your-cordo-host>/v1/streams/<stream-uuid>/ingest/text"
method = "post"
encoding.codec = "text"
[sinks.cordo_text.headers]
X-API-Key = "lax_<prefix>_<secret>"
Content-Type = "text/plain"

Each non-empty line becomes a {"message":"…"} event. Details: Ingest plain-text logs.

Vector → Elasticsearch / OpenSearch bulk

[sinks.cordo_bulk]
type = "elasticsearch"
inputs = ["your_source"]
endpoints = ["https://<your-cordo-host"]
bulk.index = "logs"
auth.strategy = "basic"
auth.user = "vector"
auth.password = "lax_<prefix>_<secret>"

The API key selects the stream; the index name is ignored by Cordo.

Vector / Fluent Bit → OTLP

Point an OTLP HTTP exporter at https://<host>/v1/otlp with X-API-Key (same as OpenTelemetry ingest).

Fluent Bit → HTTP

[OUTPUT]
    Name            http
    Match           *
    Host            <your-cordo-host>
    Port            443
    TLS             On
    URI             /v1/streams/<stream-uuid>/ingest
    Format          json
    Header          X-API-Key lax_<prefix>_<secret>
    Content_Type    application/json

Fluent Bit → HTTP plain text

[OUTPUT]
    Name            http
    Match           *
    Host            <your-cordo-host>
    Port            443
    TLS             On
    URI             /v1/streams/<stream-uuid>/ingest/text
    Format          plain
    Header          X-API-Key lax_<prefix>_<secret>
    Content_Type    text/plain

Use this only when each record is a raw line. Prefer JSON Format against /ingest when events are already objects.

Fluent Bit → OpenSearch / Elasticsearch

Use the es or opensearch output against https://<your-cordo-host> with Basic auth password = stream API key — same as OpenSearch-compatible ingest.

Next