Quickstart

By the end of this guide you will have a project receiving logs and an answer from the Sazabi agent grounded in a log you sent yourself. It takes about 10 minutes, and the fastest honest path is connecting one real log — so that is what you will do.

Most steps offer two functionally identical paths — the dashboard and the CLI. Pick whichever interface you prefer, step by step; they produce the same result.

Prerequisites

• A Sazabi account. Open the dashboard at app.sazabi.com and sign in.
• A terminal with curl for the one-event path below. If you would rather wire up a real source, the OpenTelemetry option needs an application you can add the SDK to.
• For the CLI path: the sazabi CLI installed and signed in (see CLI reference for install and sign-in).

Create your organization

Your organization is the shared space for your team, projects, and data.

1. Sign in at app.sazabi.com.
2. On the welcome screen, start the setup flow and enter a name for your organization.
3. Click Continue.

You should land on project setup. If a teammate already invited you to an organization, you will be prompted to accept the invite first instead. (Organization creation happens in the dashboard's welcome flow; the CLI signs in to an existing organization.)

Create your project

A project isolates one application or environment's telemetry.

sazabi projects create --name "Quickstart"   # add --region eu-central-1 to pick a region
sazabi projects use "<project-id>"           # set it as the active project for later commands

Sazabi stores your logs in managed storage for this project — there is no storage backend to configure.

Connect your first log source

You have two ways in. Send one test event by hand to see data land immediately, or set up OpenTelemetry for a real, continuous source.

Recommended: send one test event with curl. It proves the whole path end to end in under a minute, with nothing to install. Use OpenTelemetry instead when you want a real source flowing right away and you already run an app you can instrument. Trade-offs: the curl event is a single record you send once; OpenTelemetry is a continuous stream but takes a few minutes to wire up. Do not use the curl path as your long-term ingestion — it is a smoke test, not a source.

Get your intake URL

sazabi log-sources create otel --mode connectionless       # creates the log source and prints its intake URL

Keep the intake URL handy for the next step.

Send one test event with curl

Send a single OpenTelemetry-format log record to your log source's intake endpoint. Replace SAZABI_INTAKE_URL with the intake URL you copied plus the /v1/logs path. The intake URL authenticates on its own, so there is no Authorization header to send.

export SAZABI_INTAKE_URL="<your intake URL>/v1/logs"

curl -X POST "$SAZABI_INTAKE_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "resourceLogs": [{
      "resource": { "attributes": [
        { "key": "service.name", "value": { "stringValue": "quickstart" } }
      ]},
      "scopeLogs": [{
        "logRecords": [{
          "severityText": "INFO",
          "body": { "stringValue": "sazabi quickstart test event 8842" }
        }]
      }]
    }]
  }'

You should get an HTTP 200 with {"success":true,...}. A 200 means the envelope was accepted — you will confirm the record actually landed in the Verify step below, because acceptance alone does not guarantee a queryable record.

Set up OpenTelemetry

To send from a real application instead, point your OpenTelemetry exporter at your log source's intake URL — the same one from Settings > Log streams — with no headers needed:

export OTEL_EXPORTER_OTLP_ENDPOINT="<your intake URL>"
export OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"

Set OTEL_EXPORTER_OTLP_ENDPOINT to the unsuffixed base — the SDK appends /v1/logs and /v1/traces for you. Sazabi's OTLP intake is HTTP-only, so http/protobuf is required (the SDK default of gRPC will not connect).

For the full per-language SDK walkthrough (Node.js, Python, Go, Java, .NET, and more), see OpenTelemetry log source.

When to use a different source

Many platforms have a one-click Connect your account path — you authorize the account and Sazabi runs the forwarding for you (for example AWS CloudWatch, Google Cloud, Vercel, Sentry). Others send to an endpoint like the one above (Fluent Bit, Vector, Datadog Agent). See Choosing a path and Log source catalog for the full list.

Ask your first question

Open your project in the dashboard and start a thread. Ask the agent about the event you sent:

Find the log with body "sazabi quickstart test event 8842" and tell me its service and severity.

The Sazabi agent searches your logs, and answers with the record it found — showing the query it ran so you can verify it.

Verify

Confirm your test event is queryable and the agent can find it. New logs are normally searchable within a minute or two of acceptance.

1. In a thread, ask: Show me the log with body "sazabi quickstart test event 8842".
2. The agent returns one matching record with service.name = quickstart and severity INFO, and shows the log-search query it ran.

You can also confirm from the CLI without opening a thread — sazabi logs query runs the same search directly:

sazabi logs query "sazabi quickstart test event 8842" --last 1h

One matching row comes back with service quickstart and severity INFO.

If neither the agent nor sazabi logs query finds the log after a couple of minutes, the record was not ingested. Re-check that you copied the full intake URL, confirm the curl returned 200, and see Troubleshooting ingestion.

Further reading