Structured log integrations
Meshanics can send rollout, device, vulnerability, artifact, trust, and evidence events to Datadog, OpenObserve, or Grafana Loki. These are outbound-only connections from the control plane. They do not install another agent and do not export artifact bytes, uploaded device logs, command output, environment variables, or customer workload data.
Configure a connector
Open Integrations, select a destination in the catalog, and enter its HTTP
ingest URL and credential. Datadog uses an API key. OpenObserve and Loki use the
complete Authorization value expected by the endpoint, such as Basic ... or
Bearer .... Credentials are encrypted at rest and are not displayed after
save.
Use Test on the configured endpoint before relying on it. The test uses the same DNS checks, SSRF protection, authentication headers, payload encoding, and delivery path as a live event.
Event shape
Every record contains a bounded ECS-compatible core:
{
"@timestamp": "2026-08-27T10:00:00Z",
"ecs": { "version": "8.17.0" },
"event": {
"kind": "event",
"category": ["configuration"],
"type": ["change"],
"action": "rollout.finished",
"sequence": 4821
},
"service": { "name": "meshanics", "type": "ota-control-plane" },
"organization": { "id": "..." },
"user": { "name": "user:operator@example.com" },
"meshanics": { "subject": "...", "event_type": "rollout.finished" },
"data": { }
}
Datadog and OpenObserve receive JSON arrays. Loki receives its standard
streams wrapper with only service_name and event_action as labels; the
full structured event remains the log line to avoid high-cardinality labels.
Delivery and failure handling
Delivery is at least once. Each event has a stable delivery identifier, failed requests retry with bounded exponential backoff, and the endpoint card shows HTTP status, attempt count, and the final error. Pause an endpoint before rotating its credential, then replace the endpoint and test the replacement. Deleting an endpoint removes its pending delivery queue.
Private targets require the explicit internal-target option. Link-local, multicast, and cloud metadata addresses remain blocked. Redirects are not followed.