MeshanicsDocs
Integrations

Structured log integrations

Meshanics can send rollout, device, vulnerability, artifact, trust, and evidence events to Datadog, OpenObserve, or Grafana Loki. These are outbound-only connections from the control plane. They do not install another agent and do not export artifact bytes, uploaded device logs, command output, environment variables, or customer workload data.

Configure a connector

Open Integrations, select a destination in the catalog, and enter its HTTP ingest URL and credential. Datadog uses an API key. OpenObserve and Loki use the complete Authorization value expected by the endpoint, such as Basic ... or Bearer .... Credentials are encrypted at rest and are not displayed after save.

Use Test on the configured endpoint before relying on it. The test uses the same DNS checks, SSRF protection, authentication headers, payload encoding, and delivery path as a live event.

Event shape

Every record contains a bounded ECS-compatible core:

{
  "@timestamp": "2026-08-27T10:00:00Z",
  "ecs": { "version": "8.17.0" },
  "event": {
    "kind": "event",
    "category": ["configuration"],
    "type": ["change"],
    "action": "rollout.finished",
    "sequence": 4821
  },
  "service": { "name": "meshanics", "type": "ota-control-plane" },
  "organization": { "id": "..." },
  "user": { "name": "user:operator@example.com" },
  "meshanics": { "subject": "...", "event_type": "rollout.finished" },
  "data": { }
}

Datadog and OpenObserve receive JSON arrays. Loki receives its standard streams wrapper with only service_name and event_action as labels; the full structured event remains the log line to avoid high-cardinality labels.

Delivery and failure handling

Delivery is at least once. Each event has a stable delivery identifier, failed requests retry with bounded exponential backoff, and the endpoint card shows HTTP status, attempt count, and the final error. Pause an endpoint before rotating its credential, then replace the endpoint and test the replacement. Deleting an endpoint removes its pending delivery queue.

Private targets require the explicit internal-target option. Link-local, multicast, and cloud metadata addresses remain blocked. Redirects are not followed.