Skip to main content

Ingestion

This guide describes how log ingestion works in Conflux, including supported collection patterns, connectivity requirements, and ingestion health checks.

Ingestion Patterns​

Log Management (Conflux) supports multiple ways to get logs in:

  • Cloud-native pull — Conflux reads directly from cloud logging services, such as AWS CloudWatch log groups.
  • Storage-based collection — Conflux collects logs that cloud services export to storage locations, such as AWS S3 buckets and Azure Storage accounts.
  • Host-based collection — agents such as Metricbeat, Filebeat, Winlogbeat, and Packetbeat send host logs to Conflux.
  • Syslog — network and security appliances send syslog streams to Conflux listener endpoints.
  • HTTP — using API tokens, Cloudaware connects to SaaS tools (for example, GitLab audit streaming, OneLogin, Okta) to ingest logs.

In all cases, logs end up in the same Conflux pipeline and can be searched and correlated together.

Connectivity and Security​

  • Ensure egress from your sources to Conflux endpoints, such as COMPANYNAME-conflux.cloudaware.com, on the ports provided during onboarding.
  • Use TLS wherever supported. Conflux supports encrypted transport and encrypts data at rest.
  • For syslog, use the hostnames and ports Cloudaware provides (for example, COMPANYNAME-syslog-conflux.cloudaware.com:514 over TCP).

Work with Cloudaware Support support@cloudaware.com to confirm the exact endpoints, ports, protocols, and firewall rules required for your tenant.

Data Quality and Health​

Healthy ingestion means:

  • No unexpected gaps in log streams for key sources.
  • Volumes that match your expectations (for example, per‑account or per‑service).
  • Timely arrival of logs (acceptable delay between event time and ingestion time).

Use Conflux dashboards and searches to monitor ingestion health, and configure alerts in Monitoring or Conflux for missing logs, abnormal volumes, or ingestion errors.