JSON Logs

This feature is only available for enterprise plan.

groundcover utilizes a generic HTTP endpoint for logs in JSON format. This can be useful for integration with 3rd party services and additional collectors, or for importing log files manually.

Sending logs to the endpoint

URL

The url should be https://{incloud-site}/json/logs as described in these docs. Make sure to use the inCloud Managed site fit for your deployment.

Method

HTTP method should be set to POST. No other methods are supported.

Authentication

To authenticate the request you can use any of the methods described here. The most simple method is using an apikeyheader with your apikey, which can be fetched using the command groundcover auth print-api-key. See example below for more details.

Content Type

One request can contain multiple logs by setting the payload as a JSON array (where every entry is a log line) or by using ndjson. Make sure to set the Content-Typeheader appropriately.

Format	Required Content-Type
JSON array	application/json
ndjson	application/x-ndjson

This endpoint only supports JSON formatted logs. For other supported formats please check our datasources page.

Structure

groundcover parses JSON logs using this logic:

• Timestamp is extracted from the either of the keys timestamp, timeor ts . It is recommended to use RFC 3339 Nano format.

• Log message is extracted from either of the keys message, msg, log, body, content or text

• Additional fields will be stored as log attributes.

Example

This curlcommand sends two log lines to an example groundcover backend:

curl -X POST "https://test-site.com/json/logs" \
-H "Content-Type: application/x-ndjson" \
-H "apikey: your-api-key" \
--data-binary '{"timestamp": "2025-01-01T10:45:32.123456799Z", "msg": "sending log to groundcover", "extra-attribute": "groundcover is cool"}
{"timestamp": "2025-01-01T10:45:32.123457799Z", "msg": "more logs to groundocver", "key2": "value2", "key3": "value3"}'

Recommended Attributes

It is recommended to add the following attributes to your logs to enrich them, associating them with common groundcover concepts and making them easier to find and filter.

These are optional attributes but we highly recommend adding those where possible

Name	groundcover meaning
service.name	Workload
clusterId	Cluster
env_name	Env
gc_source_type	Source
namespace	Namespace

For example:

{
  "timestamp": "2025-01-01T10:45:32.123456799Z",
  "msg": "my awesome log line",
  "service.name": "my-workload",
  "clusterId": "my-cluster",
  "env_name": "my-env",
  "gc_source_type": "my-json-sender",
  "namespace": "my-namespace"
}