Configuration

Everything lives in one TOML file. Unknown keys are an error, so typos fail loudly at startup.

Minimal example

[state]
dir = "/var/lib/fernwick"

[[source]]
name  = "nginx"
type  = "file"
paths = ["/var/log/nginx/*.log"]

[[source]]
name  = "system"
type  = "journald"
units = ["ssh.service", "cron.service"]

[[sink]]
name     = "loki"
type     = "loki"
url      = "http://127.0.0.1:3100/loki/api/v1/push"
labels   = { host = "${HOSTNAME}" }
batch    = { max_lines = 512, max_wait = "2s" }

Sources

type	keys	notes
`file`	`paths`, `exclude`, `multiline`	Globs are re-evaluated every 10s. Rotation is tracked by inode.
`journald`	`units`, `priority`	Requires read access to the journal.
`stdin`	—	Handy for testing pipelines.

Sinks

type	keys	notes
`http`	`url`, `headers`, `format`	NDJSON by default. Retries with jittered back-off.
`loki`	`url`, `labels`, `tenant`	Uses the protobuf push API when available.
`s3`	`bucket`, `prefix`, `endpoint`	Writes gzip'd hourly objects. Works with MinIO and R2.

Buffering

[buffer]
max_size = "256MiB"   # on-disk spill limit per sink
when_full = "block"   # or "drop_oldest"