Forwarders

Choose your preferred log forwarding tool to send data to RunReveal using webhooks.

Before you begin: Make sure you have created a webhook source in RunReveal. You'll need the webhook URL to configure your log forwarders.

Choose Your Webhook Type

RunReveal supports two types of webhook sources, each with different use cases:

Structured Webhooks

Structured webhooks are designed for events that match RunReveal's normalized log format. This provides better parsing, filtering, and search capabilities.

Best for:

Security events with known structure
Events that can be normalized to RunReveal's format
Applications that can format data according to RunReveal's schema

Key Benefits:

Automatic field parsing and indexing
Better search performance
Structured query support
Built-in field validation

Data Format:

{
  "eventName": "UserLogin",
  "eventTime": "2023-11-11T13:47:58+00:00",
  "readOnly": false,
  "actor": {
    "email": "[email protected]",
    "id": "123456789",
    "username": "johndoe"
  },
  "src": {
    "ip": "192.168.1.100",
    "port": 443
  },
  "service": {
    "name": "web-application"
  },
  "tags": {
    "environment": "production",
    "source": "auth-service"
  }
}

Available Forwarders

Select your preferred log forwarding tool from the options below:

Reveald

RunReveal's official log collection agent, designed specifically for sending data to RunReveal. Setup guide →

Vector

High-performance observability data pipeline that can collect, transform, and route logs to RunReveal. Setup guide →

Fluent Bit

Lightweight log processor and forwarder that can send data to RunReveal. Setup guide →

Datadog

Configure an http forwarder within the Datadog UI to forward logs to RunReveal after being ingested by Datadog. Setup guide →

Logstash

Configure Logstash to send data to RunReveal using the HTTP output plugin. Setup guide →

Getting Started

Create a Webhook Source: Follow the instructions in any forwarder guide to create your webhook source
Choose Your Forwarder: Select the tool that best fits your environment and requirements
Configure and Deploy: Follow the step-by-step instructions for your chosen forwarder
Verify and Monitor: Test your setup and monitor log delivery

For help choosing the right forwarder for your use case, refer to the individual forwarder documentation pages.

On this page