Docs / Reference
Configuration
Sage reads its configuration from /etc/sage/sage.toml. Pass --config to use another file. The file is TOML; every option has a default, so it only needs what you change.
A complete example
# /etc/sage/sage.toml
[inputs]
files = ["/var/log/nginx/*.log", "/var/log/app/*.log"]
journald = true
[parse]
format = "json"
[outputs.http]
url = "https://logs.example.com/ingest"
[buffer]
max_size = "1GiB"Environment variables
Every option can also be set in the environment: write the key in upper case, replace dots with underscores and put SAGE_ in front, so inputs.files becomes SAGE_INPUTS_FILES. The environment wins over the file.
Options
| Option | Type | Default | Description |
|---|---|---|---|
inputs.files | list | [] | Glob patterns of files to tail. |
inputs.journald | bool | false | Read the systemd journal. |
inputs.start_at | string | end | Where to begin with a file never seen before: beginning or end. |
parse.format | string | auto | json, logfmt, regex or auto, which tries JSON and logfmt. |
parse.pattern | string | – | Regular expression with named groups, used when the format is regex. |
outputs.http.url | string | – | Endpoint to POST batches of events to. |
outputs.http.batch_size | int | 500 | Events per request. |
outputs.http.compress | bool | true | Compress requests with gzip. |
outputs.file.path | string | – | Write events to this file as JSON lines. |
buffer.path | string | /var/lib/sage/buffer | Folder of the disk buffer. |
buffer.max_size | string | 256MiB | Largest size the buffer may grow to before the oldest events are dropped. |
flush_interval | duration | 1s | Longest time an event waits before its batch is sent. |
labels | map | {} | Fields added to every event, such as the environment or the host role. |
log.level | string | info | debug, info, warn or error. |