Subscribers

Subscribers are the output targets that receive enriched events from the connector. Each subscriber is enabled with enabled: true in its config.yaml block. Multiple subscribers can run in parallel — events are fanned out through an internal pub-sub bus, so a slow or failing subscriber never blocks the others.

📄️stdout

Writes enriched events to stdout. Ordering is preserved — stdout is always serial. Logs go to stderr so they

📄️raw_http

POSTs enriched events as JSON to any HTTP endpoint. Good for AWS Lambda function URLs, generic HTTP receivers, or the

📄️elasticsearch

Indexes enriched events into Elasticsearch datastreams.

📄️s3

Batches events per namespace and uploads them as JSONL objects to S3.

📄️syslog

Forwards each event as a single compact-JSON syslog message.

📄️datadog

Posts events to Datadog as logs (HTTP intake) and/or metrics (v2 series). Logs and metrics are independent — enable

📄️splunk

Forwards events to a Splunk HTTP Event Collector (HEC) endpoint. Each event is wrapped in a HEC envelope (event +

📄️otel

Native OTLP exporter. Ships logs (every event becomes an OTLP log record) and metrics (only events in the