Explore documentation
  1. Welcome to Logs 👋
  2. Quick start guide
  3. Logs sources
    1. Programming languages
    2. Cloud platforms
    3. Web servers & Load balancers
    4. Operating systems
    5. Databases & Message queues
    6. Containers & Clusters
    7. Logging & Monitoring tools
    8. HTTP REST API
  4. Log Forwarding
    1. Vector (Recommended)
    2. Fluent Bit
    3. Logstash
    4. Fluentd
    5. Filebeat
    6. Syslog
  5. Dashboards
    1. SQL queries
    2. Query variables
    3. Transforming with JavaScript
    4. Alerts
    5. How do we bill for metrics?
  6. API
    1. Get started with Logs API
    2. Sources API
      1. List all existing sources GET
      2. Get a single source GET
      3. Create a source POST
      4. Update a source PATCH
      5. Delete an existing source DELETE
      6. Sources API response parameters
    3. Query API V2
  7. Using Logs
    1. AWS S3-compatible archive
    2. String + JSON format
    3. Formatting logs
    4. Live tail query language
    5. Explore logs with SQL
    6. Querying data in Better Stack

Create a source

Returns a newly created source.

POST https://logs.betterstack.com/api/v1/sources

Headers

Authorization
required string

Bearer $TOKEN

Body parameters

team_name
string

Required if using global API token to specify the team which should own the resource

name
required string

Source name

ingesting_paused
boolean

Enable or disable ingesting for this source

platform
string

Source platform.
The currently supported platforms are:
- apache2
- aws_cloudwatch
- aws_ecs
- aws_elb
- aws_fargate
- cloudflare_logpush
- cloudflare_worker
- datadog_agent
- docker
- dokku
- dotnet
- elasticsearch
- filebeat
- flights
- fluentbit
- fluentd
- fly_io
- haproxy
- heroku
- http
- java
- javascript
- kubernetes
- logstash
- minio
- mongodb
- mysql
- nginx
- open_telemetry
- php
- postgresql
- prometheus
- python
- rabbitmq
- redis
- render
- rsyslog
- ruby
- syslog-ng
- traefik
- ubuntu
- vector
- vercel_integration
- flights

live_tail_pattern
string

Freeform text template for formatting Live tail output with columns wrapped in {column} brackets. Example: "PID: {message_json.pid} {level} {message}"

logs_retention
integer

Data retention for logs in days. There might be additional charges for longer retention.

metrics_retention
integer

Data retention for metrics in days. There might be additional charges for longer retention.

200

The source was created

Response body

{
  "id": "95",
  "type": "source",
  "attributes": {
    "team_id": 123,
    "name": "Nginx",
    "table_name": "nginx",
    "platform": "nginx",
    "token": "FczKcxEhjEDE58dBX7XaeX1q",
    "ingesting_paused": false,
    "logs_retention": 7,
    "metrics_retention": 14,
    "live_tail_pattern": "{level} {host} {nginx.status} {nginx.method} {nginx.host} {nginx.path} {nginx.client} {nginx.agent} {message}",
    "created_at": "2021-05-27T12:30:41.695Z",
    "updated_at": "2021-06-11T14:00:50.756Z"
  }
}
422

Validation failed

Response body

{
  "errors": "Your plan doesn't support custom retention",
  "invalid_attributes": [
    "logs_retention",
    "metrics_retention"
  ]
}

Previous article

Get a single source

Next article

Update a source