logstreem ingest

Pipe anything into a dataset — a file, a stream, another command's output.

$logstreem ingest

Reads stdin or files and posts to ingest, batching and compressing as it goes.

Usage

logstreem ingest <dataset> [file...] [--format json|ndjson|csv|logfmt]

Flag	Type	Description
<dataset>	string	Target dataset. Created if it does not exist. Required.
--format <fmt>	enum	`json`, `ndjson`, `csv` or `logfmt`. Detected from the first line by default.
--timestamp-field <f>	string	Which field holds the event time. Default `_time`.
--batch-size <n>	number	Events per request. Default 1000.
--flush-interval <d>	string	Max buffering delay. Default `2s`.
--add <k=v>	string[]	Attach a constant field to every event. Repeatable.
--dry-run	boolean	Parse and print, do not send.

Examples

# A file
logstreem ingest api-gateway-prod events.ndjson

# A live stream, tagged with the host
tail -f /var/log/app.log | logstreem ingest api-gateway-prod \
  --format logfmt --add host="$(hostname)" --add env=production

# Another tool's JSON
kubectl get events -o json | jq -c '.items[]' \
  | logstreem ingest k8s-events

# Check the parse before committing to it
head -20 weird.log | logstreem ingest scratch --format logfmt --dry-run

--dry-run first, always

Format detection is good, not perfect. One --dry-run on twenty lines tells you whether the timestamp was parsed and the fields split the way you expected — before you write a million events with message as the only field.

Previouslogstreem login Nextlogstreem query