Sources and destinations

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/sources"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/ee9c0683-4ab7-4869-8947-d0bdaaa9f38c/social-card.svg?v=3e7ae33eec8b" alt="Sources and destinations" width="600" height="315"></a>

Everything that can send data to a project, and where copies can go. The catalog is served at GET /v1/projects/{prj}/sources and shown on the Sources page. A receiver is "enabled" when the project has a credential whose scope matches the entry (create one under Settings, Credentials).

Send the key as Authorization: Bearer wti_YOUR_KEY to https://ingest.example.com unless the protocol dictates its own header (Splunk HEC Authorization: Splunk <key>, Datadog DD-API-KEY).

Entry

Endpoint

Signals

Loki push

POST /loki/api/v1/push

logs

Splunk HEC

POST /services/collector/event

logs, metrics

Elasticsearch bulk

POST /_bulk

logs

Zipkin v2

POST /api/v2/spans

traces

Jaeger

POST /api/traces

traces

Sentry envelope

POST /api/{project}/envelope/

errors

AWS Firehose

POST /aws/firehose

logs, metrics

GCP Pub/Sub push

POST /gcp/pubsub

logs

Delivery is at-least-once. Receivers listed here that are not yet served by the gateway return 404 until their gateway task ships.

Destinations

S3 and OTLP HTTP export destinations are managed under /v1/projects/{prj}/export-destinations (logs and traces, optional filter expression). Secrets are write-only.

Updated