Troubleshooting ingestion

When data is not arriving the way you expect, work down this checklist. It moves from the most common cause (the intake URL) to the intake page, then to the shape of the records once they arrive. Start at the top; each step confirms or rules out one cause.

My logs aren't showing up

Check the intake URL

Most ingestion failures are a wrong or stale intake URL.

1. Confirm the source points at the intake URL for this project. The URL is project-scoped; one copied from another project routes elsewhere. Get the current URL from Settings > Log streams — open your log source and copy the Intake URL from its setup screen.
2. Confirm you copied the whole URL, unchanged, including the keyed hostname and region — the public key is embedded in the host, so a truncated or hand-edited URL sends to the wrong place.
3. Confirm the log stream is active. A paused stream rejects data; the embedded key follows the stream's state. See Manage log streams. (The public key itself lives under Settings > Public keys for advanced use.)

Check ingestion volume

1. Open the Intake page and select a recent range.
2. If the source shows zero bytes, nothing is arriving — the problem is upstream (the source is not sending, or is sending to the wrong endpoint or key).
3. If the source shows volume but you cannot find the records, the data is arriving and the issue is in how you are searching or in the record shape (see below).

Check the log stream

1. Go to Settings > Log streams and open the source.
2. Confirm the relevant stream is active. A paused stream rejects data until you resume it. See Manage log streams.

Logs arrive but look wrong

Timestamps

If records land at the wrong time, the source is likely sending timestamps in an unexpected unit or timezone, or without a timestamp so ingestion time is used. Confirm your exporter or forwarder sends timestamps in the format the source expects.

Severity mapping

If everything shows as one severity, the source may not be mapping its levels to standard severities. Check that your exporter sets a severity field the source recognizes.

Attributes

If fields you expect are missing, confirm they are being sent as structured attributes rather than embedded in a free-text message. Structured JSON payloads are parsed into searchable fields; unstructured text is searchable but not broken into fields.

Volume is too low or too high

• Too low. A source is dropping records, sampling, or filtering before it forwards. Check the source's own configuration for what it sends.
• Too high. A noisy source is forwarding more than you intend. Narrow what it sends at the source, or split it into a separate stream you can pause.

Getting help

If you have worked through this checklist and data still is not arriving correctly, open a thread and ask the Sazabi agent to help diagnose the source, or contact support with your project and the source you are configuring.

Further reading