Skip to main content
MoleSignal speaks 10 ingest protocols, so most existing agents and SDKs work without changes. Every endpoint is authenticated with Authorization: Bearer <jwt> (or an API token — see Security).

​
Supported protocols

ProtocolEndpointDrop-in for
OTLP gRPC:5082OpenTelemetry SDK / Collector
OTLP HTTPPOST /api/v1/{logs,metrics,traces}OTel HTTP exporter
Prometheus remote_writePOST /api/v1/prometheus/api/v1/writePrometheus / VictoriaMetrics
Elasticsearch _bulkPOST /api/v1/_bulkFilebeat, Vector ES sink, Logstash
Loki pushPOST /api/v1/loki/api/v1/pushPromtail, Vector Loki sink
Syslog UDP/TCP[syslog].udp_bind / tcp_bindrsyslog, syslog-ng
Kinesis FirehosePOST /api/v1/_kinesis_firehoseAWS Firehose
Cloudflare LogpushPOST /api/v1/_cloudflareCloudflare Logpush
Heroku log drainPOST /api/v1/_herokuHeroku
Native HTTP JSONPOST /api/v1/ingest/{type}/:streamcurl / app SDK

​
Native HTTP JSON

The simplest path. POST an array of records to ingest/{logs,metrics,traces}/{stream}. Timestamps are microseconds since the Unix epoch, in the _timestamp field. 
curl -X POST http://localhost:5080/api/v1/ingest/logs/app \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '[{"_timestamp":1700000000000000,"level":"error","msg":"db pool exhausted","trace_id":"abc123"}]'
The stream is created on first write and its schema evolves as new fields appear.

​
OpenTelemetry

Point your OTel HTTP exporter at MoleSignal:
exporters:
  otlphttp:
    endpoint: http://localhost:5080/api/v1
    headers:
      authorization: "Bearer ${MS_JWT}"
Logs, metrics, and traces post to /api/v1/logs, /api/v1/metrics, and /api/v1/traces.

​
Prometheus remote_write

Add MoleSignal as a remote write target in prometheus.yml: 
remote_write:
  - url: http://localhost:5080/api/v1/prometheus/api/v1/write
    authorization:
      credentials: "${MS_JWT}"

​
Loki and Elasticsearch

POST /api/v1/loki/api/v1/push
# Works with Promtail and the Vector Loki sink.

​
Pipeline functions

You can transform events on the ingest hot path with pipeline functions — reusable transforms attached to a pipeline step. Two languages are supported:
  • VRL — always available. Compiled per (function_id, updated_at) with the vrl::compiler stdlib (del, parse_json, to_int, match, encrypt/decrypt, …).
  • JavaScript — opt-in, built on deno_core (V8). Disabled by default; enabling it requires both a build feature (--features molesignal-bootstrap/js-runtime) and the TOML gate [functions] js_runtime_enabled = true.
The JS isolate is deliberately minimal: no fetch, no setTimeout, no import, no npm. Each event gets a 50 ms wall-clock budget and a 32 MiB heap. Anything beyond a single synchronous pass is unsupported by design.
// Lowercase a `severity` field into a new `level` field.
molesignal.set("level", molesignal.fields.severity.toLowerCase());
// Drop a sensitive field.
molesignal.del("pw");