# Send messages to OpenObserve

New to AxoSyslog? AxoSyslog is a binary compatible `syslog-ng` replacement, from the original creator, developed by the same team.

Same architecture, same config files, same paths. Cloud-native images, fast releases, modern observability (OTel, K8s), and powerful data processing: read more about the [differences between AxoSyslog and `syslog-ng`](<https://axoflow.com/axosyslog-vs-syslog-ng?utm_source=docs&utm_medium=banner>).

Also, it’s super easy to [install](../../docs/axosyslog-core/install/index.md), and you can [upgrade from `syslog-ng` in minutes](../../docs/axosyslog-core/install/upgrade-syslog-ng/index.md).

Starting with version 4.5.0, AxoSyslog can send messages to [OpenObserve](<https://openobserve.ai/docs/api/ingestion/logs/json/>) using its [Logs Ingestion - JSON API](<https://openobserve.ai/docs/api/ingestion/logs/json/>). This API accepts multiple records in batch in JSON format.

## Prerequisites

  * An [OpenObserve account](<https://openobserve.ai/>) for AxoSyslog, or
  * a [self-hosted OpenObserve deployment](<https://openobserve.ai/docs/quickstart/#self-hosted-installation>).
  * To configure AxoSyslog, you’ll need the username, password, the name of your organization, and the name of the OpenObserve stream where you want to send your data.



Minimal configuration:
```
 
    @include "scl.conf"
    # ...
    
    destination d_openobserve {
      openobserve-log(
        url("http://your-openobserve-endpoint")
        organization("your-organization")
        stream("your-example-stream")
        user("root@example.com")
        password("V2tsn88GhdNTKxaS")
      );
    };
    
```

Example configuration:
```
 
    @include "scl.conf"
    # ...
    
    destination d_openobserve {
      openobserve-log(
        url("https://api.openobserve.ai")
        port(443)
        organization("your-organization")
        stream("your-example-stream")
        user("root@example.com")
        password("V2tsn88GhdNTKxaS")
      );
    };
    
```

This driver is actually a reusable configuration snippet configured to send log messages using the `http()` driver using a template. You can find the source of this configuration snippet on [GitHub](<https://github.com/axoflow/axosyslog/blob/master/scl/openobserve/openobserve.conf>).

## Options

The following options are specific to the `openobserve-log()` destination. But since this destination is based on the `http()` destination, you can use the [options of the `http()` destination](../../docs/axosyslog-core/chapter-destinations/configuring-destinations-http-nonjava/reference-destination-http-nonjava/index.md) as well if needed.

> Note: The `openobserve-log()` destination automatically configures some of these `http()` destination options as required by the OpenObserve Ingest API.

## organization()

|   
---|---  
Type: | string  
Default: | `"default"`  
  
_Description:_ The name of the [OpenObserve organization](<https://openobserve.ai/docs/user-guide/organizations/>) where AxoSyslog sends the data.

## password()

|   
---|---  
Type: | string  
Default: | -  
  
_Description:_ The password for the username specified in the `user()` option.

## port()

|   
---|---  
Type: | integer  
Default: | `5080`  
  
_Description:_ The port number of the server.

## record()

|   
---|---  
Type: | string  
Default: | `"--scope rfc5424 --exclude DATE --key ISODATE @timestamp=${ISODATE}"`  
  
_Description:_ A JSON object representing key-value pairs sent to OpenObserve, formatted as [AxoSyslog value-pairs](../../docs/axosyslog-core/chapter-concepts/concepts-value-pairs/option-value-pairs/index.md). By default, the `openobserve-log()` destination sends the RFC5424 fields as attributes. If you want to send different fields, override the default content of the `record()` field.

## stream()

|   
---|---  
Type: | string  
Default: | `"default"`  
  
_Description:_ The [OpenObserve stream](<https://openobserve.ai/docs/user-guide/streams/>) where AxoSyslog sends the data, for example, `your-example-stream`.

## user()

|   
---|---  
Type: | string  
Default: | -  
  
_Description:_ The username of the account, for example, `root@example.com`.

## url()

|   
---|---  
Type: | string  
Default: | -  
  
_Description:_ The base URL of the OpenObserve Ingest API. The actual URL is constructed from the base URL and some other options of the destination: `url():port()/api/organization()/stream()/_json`

Last modified January 14, 2026: [Fix type keyword in frontmatter (2c54f5f)](<https://github.com/axoflow/axosyslog-core-docs/commit/2c54f5f2b98d4f14096313e9b73f5d169d659346>)