source: Read, receive, and collect log messages

Configure source drivers to collect messages from files, network protocols, local system logs, OpenTelemetry, Kubernetes, and applications.
How sources work

Arr logs

axosyslog-otlp(): Receive logs from another node using OpenTelemetry

Collect native macOS system logs

default-network-drivers: Receive and parse common syslog messages

ehttp: Receive logs over HTTP

elasticsearch-bulk: Receive messages from Elastic clients

file: Collect messages from text files

Hypr Audit Trail and Hypr App Audit Trail

internal: Collect internal messages

Jellyfin logs

kubernetes: Collect and parse the Kubernetes CRI (Container Runtime Interface) format

linux-audit: Collect messages from Linux audit logs

mbox: Convert local email messages to log messages

mqtt: receiving messages from an MQTT broker

network: Collect messages using the RFC3164 protocol (network() driver)

nodejs: Receive JSON messages from nodejs applications

Collect OpenBSD kernel log messages

Receive logs, metrics, and traces from OpenTelemetry

osquery: Collect and parse osquery result logs

pacct: Collect process accounting logs on Linux

Pi-hole Faster Than Light logs

pipe: Collect messages from named pipes

program: Receive messages from external applications

python: writing server-style Python sources

python-fetcher: writing fetcher-style Python sources

qBittorrent logs

snmptrap: Read Net-SNMP traps

splunk-hec: Receive messages from Splunk HEC clients

stdin: Collect messages from the standard input stream

sun-streams: Collect messages on Sun Solaris

syslog: Collect messages using the IETF-syslog protocol

system: Collect the system-specific log messages of a platform

systemd-journal: Collect messages from the systemd-journal system log storage

systemd-syslog: Collect systemd messages using a socket

tcp, tcp6, udp, udp6: OBSOLETE - Collect messages from remote hosts using the BSD syslog protocol

unix-stream, unix-dgram: Collect messages from UNIX domain sockets

Webhook

wildcard-file: Collect messages from multiple text files

Last modified September 23, 2026: Adds frontmatter descriptions to top-level sections (a27cc77e)