Inputs

Inputs are where events come from. Sage can tail files and read the systemd journal, and it can do both at once.

#Files

[inputs]
files = ["/var/log/nginx/access.log", "/var/log/app/*.log"]
journald = true

Patterns are expanded every few seconds, so files created later are picked up without a restart. A file is followed through rotation whether it is renamed or truncated: Sage keeps reading the old file until it has reached its end, then switches to the new one.

#The journal

With inputs.journald set, every journal entry becomes an event. The message is the message field and the journal's own fields, such as _SYSTEMD_UNIT and PRIORITY, are kept in lower case.

#Where reading starts

A file Sage has never seen is read from its end, so starting it on a busy machine does not resend old logs. Set inputs.start_at to beginning to read whole files instead. Positions are kept in /var/lib/sage and survive restarts.