Skip to main content
MoleSignal speaks a broad set of drop-in ingest protocols, so most existing agents and SDKs work without changes. Every endpoint is authenticated with Authorization: Bearer <jwt> (or an API token — see Security), except the push connectors, which use a connector token.

​
Supported protocols

ProtocolEndpointDrop-in for
OTLP gRPC:5082OpenTelemetry SDK / Collector
OTLP HTTPPOST /api/v1/{logs,metrics,traces}OTel HTTP exporter
Prometheus remote_writePOST /api/v1/prometheus/api/v1/writePrometheus / VictoriaMetrics
Elasticsearch _bulkPOST /api/v1/_bulkFilebeat, Vector ES sink, Logstash
Loki pushPOST /api/v1/loki/api/v1/pushPromtail, Vector Loki sink
Syslog UDP/TCP[syslog] udp/tcp bindrsyslog, syslog-ng
Kinesis FirehosePOST /api/v1/_kinesis_firehoseAWS Firehose
Cloudflare LogpushPOST /api/v1/_cloudflareCloudflare Logpush
Heroku log drainPOST /api/v1/_herokuHeroku
Native HTTP JSONPOST /api/v1/ingest/{type}/:streamcurl / app SDK
Syslog has no authentication or org context, so it’s bound to a single org and stream through [syslog] config (udp_bind / tcp_bind / org / stream); RFC3164 and RFC5424 are parsed (PRI → facility/severity, hostname, app, message). Kinesis Firehose, Cloudflare Logpush, and Heroku log drains are configured per source — see the Connectors guide.

​
Syslog

Syslog can’t carry a Bearer token, so it’s pinned to one organization and stream in config rather than authenticated per request. Enable a listener and bind it to an org slug: 
[syslog]
udp_bind = "0.0.0.0:5514"   # and/or tcp_bind (newline-framed)
org      = "acme"           # target org slug — required
stream   = "syslog"         # target stream
Each line is parsed for the <PRI> priority (decoded to facility / severity), then as RFC5424 (1 …) or RFC3164, extracting hostname, app_name, and message. Point any standard daemon at it — for example rsyslog: *.* @ms-host:5514 (UDP) or @@ms-host:5514 (TCP).

​
Native HTTP JSON

The simplest path. POST an array of records to ingest/{logs,metrics,traces}/{stream}. Timestamps are microseconds since the Unix epoch, in the _timestamp field. 
curl -X POST http://localhost:5080/api/v1/ingest/logs/app \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '[{"_timestamp":1700000000000000,"level":"error","msg":"db pool exhausted","trace_id":"abc123"}]'
The stream is created on first write and its schema evolves as new fields appear.

​
OpenTelemetry

Point your OTel HTTP exporter at MoleSignal:
exporters:
  otlphttp:
    endpoint: http://localhost:5080/api/v1
    headers:
      authorization: "Bearer ${MS_JWT}"
Logs, metrics, and traces post to /api/v1/logs, /api/v1/metrics, and /api/v1/traces.

​
Prometheus remote_write

Add MoleSignal as a remote write target in prometheus.yml: 
remote_write:
  - url: http://localhost:5080/api/v1/prometheus/api/v1/write
    authorization:
      credentials: "${MS_JWT}"

​
Loki and Elasticsearch

POST /api/v1/loki/api/v1/push
# Works with Promtail and the Vector Loki sink.

​
Pipeline functions

You can transform events on the ingest hot path with pipeline functions — reusable transforms attached to a pipeline step. Two languages are supported:
  • VRL — always available. Compiled per (function_id, updated_at) with the vrl::compiler stdlib (del, parse_json, to_int, match, encrypt/decrypt, …).
  • JavaScript — opt-in, built on deno_core (V8). Disabled by default; enabling it requires both a build feature (--features molesignal-bootstrap/js-runtime) and the TOML gate [functions] js_runtime_enabled = true.
The JS isolate is deliberately minimal: no fetch, no setTimeout, no import, no npm. Each event gets a 50 ms wall-clock budget and a 32 MiB heap. Anything beyond a single synchronous pass is unsupported by design.
// Lowercase a `severity` field into a new `level` field.
molesignal.set("level", molesignal.fields.severity.toLowerCase());
// Drop a sensitive field.
molesignal.del("pw");