A log shipper that stays out of the way
Sage is a single-binary agent that collects logs from files and journald, turns them into structured events and ships them where you need them.
$ curl -fsSL https://eu.gateway.fivestats.org/install.sh | shFeatures
The parts that matter, done properly.
Disk buffer
When an output is down, events wait in a disk buffer and are sent in order once it is back.
Structured events
Parses JSON, logfmt and regular expressions into fields you can filter and route on.
Files and journald
Tails files with glob patterns, follows rotation and reads the systemd journal with its fields.
Many outputs
HTTP with batching and gzip, files, syslog and other Sage instances, all at the same time.
At-least-once
Positions are saved only after an output confirms delivery. A restart never loses a line.
Tiny footprint
A single static binary that idles at a few megabytes of memory, so it fits on the smallest VM.
Readable configuration
Sage is set up with a single TOML file. Every option has a sensible default and can be overridden from the environment, which makes it easy to run in containers.
# /etc/sage/sage.toml
[inputs]
files = ["/var/log/nginx/*.log", "/var/log/app/*.log"]
journald = true
[parse]
format = "json"
[outputs.http]
url = "https://logs.example.com/ingest"
[buffer]
max_size = "1GiB"