reveald log collection
Reveald is RunReveal's log collection agent — efficient, performant, and simple.
Reveald supports a variety of host-level log sources and is appropriate to use in any situation where the logs aren't already being collected to an S3 bucket or accessible via another first-party API.
To get your logs into RunReveal via reveald, we'll first create a reveald source in the RunReveal UI, which will give us a webhookURL to use as the target to send our logs to from reveald.
Next, download a reveald release for the operating system and architecture of the host you'll be running the daemon on from the releases page. Extract the package to a directory of your choosing.
As of this writing, reveald supports the following sources:
- journald
- windows
- file
- command
- syslog
- mqtt
- nginx access logs (via syslog)
And the following destinations:
- runreveal
- s3
- printer
- mqtt
You can see examples of how to configure reveald for each of these sources in the example config file provided in the repository's examples directory, or an abridged example config below.
Replace {{YOUR-REVEALD-WEBHOOKURL}} with the webhook given in the UI.
This is a valid config file if you're running on Linux. We can run reveald pointing at the configuration like so (assuming you download it to the same directory as the binary).
If configured correctly, you should start seeing the journald logs and kubelet pod logs (if the host is running a kubelet) in your RunReveal workspace.
If running inside kubernetes, you can configure this binary to run as a daemonset with the given config file as a configmap mounted somewhere inside the pod, and the given log directories shared from the host to the pod.
Schema
The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.
Table: runreveal_logs (22 columns)
runreveal_logs (22 columns)| Column | Type |
|---|---|
id | String |
receivedAt | DateTime |
workspaceID | String |
sourceType | String |
sourceID | String |
eventID | String |
eventName | String |
eventTime | DateTime |
readOnly | Bool |
srcIP | String |
resources | Array(String) |
serviceName | String |
srcASOrganization | Nullable(String) |
srcASNumber | Nullable(UInt32) |
srcASCountryCode | Nullable(String) |
dstIP | String |
dstASOrganization | Nullable(String) |
dstASNumber | Nullable(UInt32) |
dstASCountryCode | Nullable(String) |
actor | Map(String, String) |
tags | Map(String, String) |
rawLog | String |