Ingesting logs

How ingest works

• You send batches over HTTPS to logs.uptimeeye.com with an ingest key.
• The key resolves to your organization; lines are stored in your organization's isolated tenant.
• Each line becomes an entry with a message, a time and any number of fields. No schema, no index configuration.
• About a second later the entry is searchable on the Logs page; Live tail shows it after ~6 s.

Ingest keys

Create keys under API Keys → New API Key with type “Log ingest”. They start with ue_ingest_, are shown once, and can only write logs — a management key (ue_live_) is refused by the ingest endpoints, and an ingest key cannot read or change anything in your account.

Send the key as a bearer token, or as HTTP basic auth for tools that only know user/password (any user name, the key as password):

Authorization: Bearer ue_ingest_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
# or
Authorization: Basic base64("key:ue_ingest_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX")

Endpoints

Base URL https://logs.uptimeeye.com. All endpoints accept gzip-compressed bodies (Content-Encoding: gzip) up to 16 MiB uncompressed.

Message, time and fields

An entry is a flat set of string fields. Three names are special; everything else is yours:

Nested JSON is flattened to dotted names: {"http":{"status":500}} becomes the field http.status. Arrays are stored as JSON strings. Field names are case-sensitive.

Good field hygiene

• Always send service and env — they drive the fields panel, the setup examples and most filters.
• Put identifiers (order_id, user_id, trace_id) into fields, not into the message text.
• Keep one name per concept across services (duration_ms, not latency here and took there).
• Log levels as lowercase words (info, warn, error) so level:error works everywhere.

Stream fields

A stream is the set of entries sharing the same values of the stream fields — think {service="api", env="prod"}. Streams are stored together, so a filter on them (_stream:{...}, or simply a chip on a stream field) is the fastest way to narrow a search, and the fields panel lists stream fields first.

• Choose them per request with _stream_fields=service,env (query arg or VL-Stream-Fields header). Up to 6 fields; the default is service,host.
• Pick fields with few distinct values that you filter on constantly: service, env, namespace, region, host.
• Never use high-cardinality values (request_id, pod on a busy cluster, user_id) — every distinct combination is a separate stream.

Ingest options

Options are passed as query arguments on any endpoint, or as headers for agents that cannot set the URL. Query arguments win.

The plain-text endpoint adds _time_source=ingest and _multiline=off, and treats every non-underscore query argument as a constant field.

Limits, quota, retention

Response codes

Choose an integration

Verify

Open Logs, choose the 15m range and search service:=<your service>. If nothing shows up, check the agent's log for the HTTP status of its last request (see the table above), and the time: an agent that sends timestamps from a clock that is off by minutes puts lines outside the 15m window — try 24h.

Then continue with Searching logs.

FAQ