Ingest your logs
You will learn which ingest path to use and where to go next for each method.
Cordo accepts schema-free JSON and explicitly identified plain-text lines through one shared pipeline (ingest → observe → materialize). Pick the dial-tone that matches how you already ship logs.
| Method | When to use | Auth | Guide |
|---|---|---|---|
| Native HTTP JSON | Apps, scripts, custom collectors | Stream API key (X-API-Key) |
Ingest JSON logs |
| Native HTTP plain text | Unstructured one-line-per-event logs | Stream API key (X-API-Key) |
Ingest plain-text logs |
| OpenSearch-compatible bulk | DigitalOcean App Platform and similar forwarders | HTTP Basic (password = API key) | OpenSearch-compatible ingest |
| OTLP Logs (HTTP) | OpenTelemetry Collector and OTLP exporters | Stream API key (X-API-Key or Bearer) |
OpenTelemetry ingest |
| Vector / Fluent Bit | Sidecar / DaemonSet collectors | Same as native, OpenSearch, or OTLP | Ingest with Vector and Fluent Bit |
MCP ingest_events |
Agents writing sample events | Personal access token (lxp_…) |
Connect MCP |
Traces and metrics are out of scope — Cordo accepts OTLP Logs only.
Before any method
- Create a stream — Create and manage streams.
- Mint a stream API key (
lax_…) — Manage stream API keys (except MCP samples, which use a PAT).
After accept
Events land in Postgres immediately (Events can show them). Fields and shapes update as Cordo observes payloads. Query and analytics catch up after materialization.
Next
New to Cordo? Start with native curl in Send your first events, then return here for production dial-tones.