Onboard your first log

This walkthrough takes a fresh host all the way to a live log pipeline: install a collector, point it at a log file, route the records to a destination, and verify they arrive. It’s the path most operators take on day one.

By the end you’ll have a collector reading a log file, a route forwarding those records to a destination, and a topology canvas that shows the records flowing. Total time: about 10 minutes.

Before you start

You need:

• A running LinkMesh server you can reach in a browser (the Quickstart brings one up with Docker Compose).
• A Linux host that produces a log file you want to collect — anything under /var/log works. This walkthrough uses /var/log/app.log.
• Admin access to the server UI.

1. Install the collector

On the host, run the OpAMP install snippet. The server hands you a personalised one-liner under Collectors → + Add Collector; it bakes in your server URL and a single-use enrollment token:

curl -fsSL https://<your-server>/install-opamp.sh | sudo sh -s -- --token <enrollment-token> --env production

The script installs otelcol-contrib and the OpAMP supervisor as a systemd service, then connects back over the control channel. Within a few seconds the host appears in Collectors, online and awaiting configuration.

The Collectors page after enrollment — the new host is online, in OpAMP mode, with no sources or routes attached yet.

Tip

Installing the optional agent alongside the collector adds host-side service and log discovery, so the onboarding workbench can suggest log files for you instead of typing the path by hand. It connects on the same enrollment token.

An enrolled agent reporting the service-detection and log-discovery capabilities it offers the onboarding workbench.

2. Add a log source

A source is the receiver side of the pipeline — what reads telemetry into the collector. Open Sources and create one from the File Tail template.

The Sources library. Each entry is a receiver template; File Tail tails one or more log files on the collector host.

Give it a name (App logs), set the signal type to logs, and set the include path to the file you want to read:

include:
  - /var/log/app.log

A File Tail source configured to read /var/log/app.log. The include list accepts glob patterns, so /var/log/*.log tails a whole directory.

Note

A File Tail source reads new lines from the moment the collector starts watching the file — existing lines written before that point aren’t replayed. Append a fresh line after the route is live (step 5) to see it flow.

3. Add a destination

A destination is where matched records leave the collector. Open Destinations and create one — Grafana Cloud Loki, an OTLP endpoint, Elasticsearch, and others ship as templates. Fill in the connection details for your backend; this walkthrough sends to an OTLP endpoint.

The Destinations library. Pick the exporter that matches your backend and fill in its connection settings — endpoint, credentials, TLS.

4. Wire a route on the collector

A source reads records and a destination receives them, but nothing connects the two until a route does. Open the collector, switch to the Routing tab, and create a route:

• Pipeline: leave it as the passthrough pipeline (no processing), or pick one you’ve built — see Build your first pipeline.
• Destination: the destination from step 3.
• Filter: leave it as true to accept every record.

Save the route. The collector regenerates its configuration and applies it within a few seconds — the Last applied timestamp on the collector detail page is the authoritative confirmation.

The collector detail page. The Routing tab is where sources, pipelines, and destinations are wired together for this collector.

5. Verify records are flowing

Append a line to the log file on the host so the File Tail source has something fresh to read:

echo "$(date -u +%FT%TZ) INFO hello from my first log source" >> /var/log/app.log

Open Topology from the sidebar. The canvas draws the collector and the destination as nodes, with the active route between them.

The topology canvas. The collector forwards logs to the destination over the route you just created; the LOGS badge marks the signal type carried.

The line you appended travels File Tail → route → destination. Confirm it arrived at your backend (the records carry linkmesh.source.id and linkmesh.source.name attributes, added by the route so you can tell which source they came from). That’s the full path — source to destination, verified.

What’s next

• Build your first pipeline — insert processing between the source and destination: parse, redact, drop, enrich
• Drop noisy logs — filter health-check probes and other access-log noise before they cost you anything downstream
• Route to Grafana Cloud Loki — a concrete destination walkthrough end-to-end
• Concepts: Source · Route · Destination — the model behind each step above