Log ingestion and protocol adaptation components.
ingestion/
├── service/ # Log Ingestion Service (HTTP/gRPC)
│ ├── core/ # Business logic & batch processing
│ ├── http/ # HTTP REST handlers
│ └── grpc/ # gRPC service implementation
└── adapters/ # Benthos protocol adapters (Syslog/Kafka/S3)
1. Log Ingestion Service (service/)
Unified entry point for log submissions:
- HTTP API:
POST /v1/logs - gRPC API:
LogIngestion.SubmitLog - Processing: Hash generation, batch write to DB, Kafka publishing
2. Benthos Adapters (adapters/)
Protocol conversion for heterogeneous sources:
- Syslog: UDP/TCP 514 → HTTP
- Kafka: Topic consumption → HTTP
- S3: File processing → HTTP
Client → Nginx → Ingestion Service → Kafka → Engine
↓
Database
Syslog/Kafka/S3 → Benthos → Ingestion Service → Kafka → Engine
↓
Database
- Async Processing: Immediate response with
request_id - Batch Optimization: Batched DB writes and Kafka publishes
- Hash Deduplication: SHA-256 log hash as unique key
- Protocol Agnostic: HTTP, gRPC, Syslog, Kafka, S3 supported
- Service:
config/ingestion.defaults.yml - Adapters:
docker-compose.ymlenvironment variables
See:
cmd/ingestion/README.md- Running service locallyservice/README.md- Service architectureadapters/README.md- Adapter configuration