Logs ingest
Send structured logs, optionally correlated with traces.
Logs are stored in ClickHouse and searchable from the console and POST /api/v1/logs/query.
Single log
POST https://ingest.sensobit.com/api/v1/logs
curl -X POST https://ingest.sensobit.com/api/v1/logs \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"namespace": "production",
"host": "web-01",
"service": "checkout",
"level": "error",
"message": "payment provider timeout",
"source": "app",
"trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"span_id": "00f067aa0ba902b7",
"log_fields": { "order_id": "ord_9f3" },
"tags": { "region": "ap-south-1" },
"timestamp": "2026-09-20T05:00:00Z"
}'message is required. timestamp accepts RFC3339 or RFC3339Nano.
Batch
POST https://ingest.sensobit.com/api/v1/logs/batch
{
"namespace": "production",
"logs": [
{
"host": "web-01",
"service": "nginx",
"level": "info",
"message": "GET /health 200",
"source": "file"
},
{
"host": "web-01",
"service": "nginx",
"level": "warn",
"message": "upstream timed out",
"source": "file"
}
]
}Agent file collection
In /etc/sensobit/config.yaml:
logs:
enabled: true
batch_size: 200
interval: 15s
journald: false
docker: false
files:
- path: "/var/log/syslog"
service: "syslog"
format: "syslog"
- path: "/var/log/nginx/access.log"
service: "nginx"
format: "plain"Enable journald or docker only when you need those sources. Both spawn extra readers and increase CPU.
Query and correlate
curl -X POST https://api.sensobit.com/api/v1/logs/query \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"namespace": "production",
"service": "checkout",
"level": "error",
"limit": 100
}'Related routes:
GET /api/v1/logs/levelsGET /api/v1/logs/servicesGET /api/v1/logs/hostsGET /api/v1/logs/patternsGET /api/v1/logs/correlate/traces/:trace_idPOST /api/v1/logs/correlate/metrics
If you include trace_id and span_id on the log, APM and the traces view can jump from a span to matching log lines.