Gather
Gather is the first stage of the LogDoc pipeline. It collects log entries from any number of sources and normalizes them into structured events.
How Gathering Works
Every configured source runs inside the gather stage. Sources either listen for incoming data or actively poll their targets, then hand entries over to the pipeline:
Sources listen on network ports or watch files and system journals
Raw entries are parsed into structured events with typed fields
Host, source name and timestamps are attached as metadata
Events are queued and handed to the Pipe stage for routing
Supported Sources
LogDoc ships with built-in sources for the most common log origins. Additional sources can be added via plugins.
Syslog — RFC 3164 / RFC 5424 over TCP and UDP
Journald — native systemd journal reader
File — tail files with glob patterns and rotation support
LogDoc TCP / UDP / HTTP — native protocol receivers
Docker — container stdout and stderr streams
Configuration Example
Sources are declared under the gather key of logdoc.yml:
yaml
gather:
sources:
- type: syslog
bind: 0.0.0.0:514
protocol: udp
- type: file
path: /var/log/nginx/*.log
multiline: true
Sources can be added at runtime through the REST API or the web UI — no restart required. See the Configuration guide for the full list of per-source options.