ingestion-format-support
OpenObserve supports ingestion in both JSON and HEC formats.
If your log files are in JSON format, use the following endpoint:
https://api.openobserve.ai/api/<organization_id>/<stream_id>/_jsonExample: Ingest JSON-formatted Logs Using cURL
curl https://api.openobserve.ai/api/<organization_id>/<stream_id>/_json -i -u "root@example.com:Complexpass#123" -d "@k8slogs_json.json" If your log files are in HEC format, use the following endpoint:
https://api.openobserve.ai/api/<organization_id>/_hecThe endpoint has no stream segment: each event's index field names the stream, and events without one go to _hec (set by ZO_INGEST_DEFAULT_HEC_STREAM). For Splunk forwarders that authenticate with a Splunk HEC token, use the Splunk HEC endpoint instead.
This ingestion method is useful for teams migrating from Splunk or using tools that generate logs in HEC format.
Example: Ingest HEC-formatted Logs Using cURL
curl https://api.openobserve.ai/api/<organization_id>/_hec -i -u "root@example.com:Complexpass#123" -d "@logs_hec.hec" Note
Ensure that the log file matches the required format for the selected endpoint. Improperly formatted files will result in ingestion errors.
OpenObserve: Cloud Native Observability Platform
OpenObserve is a cloud native observability platform for logs, metrics, and traces, with 140x lower storage costs and petabyte-scale performance.
Custom AI Toolsets
Extend the OpenObserve AI agent with organization-scoped custom toolsets: MCP servers, CLI tools, Markdown skills, and generic configs for the SRE Agent.