Skip to main content
Logwiz acts as an authenticated HTTP ingest gateway in front of Quickwit. Your log shippers send data to Logwiz instead of directly to Quickwit, so you can keep Quickwit private and manage access with per-index bearer tokens. If you are using the default setup, the built-in otel-logs-v0_9 OpenTelemetry index is ready to receive logs immediately. See Indexes for full schema details and field mapping.
1

Create an ingest token

Open Administration -> Send Logs, create a token, and copy it before closing the dialog. The token value is shown only once. Each token can optionally be scoped to specific index IDs.
2

Choose your target index

Pick the Quickwit index you want to write to. If you are using the default setup, that is otel-logs-v0_9. See Indexes to learn about the built-in index and custom indexes.
3

Post logs to the Logwiz gateway

Send NDJSON to /api/ingest/{indexId} on your Logwiz instance. Replace the index ID and payload with values that match your index schema.
curl -X POST 'https://logs.example.com/api/ingest/<your-index-id>?commit=wait_for' \
  -H 'Authorization: Bearer <your-ingest-token>' \
  -H 'Content-Type: application/x-ndjson' \
  --data-binary @- <<'EOF'
{"timestamp_nanos":1776340800000000000,"severity_text":"INFO","body":{"message":"User logged in"},"service_name":"frontend","attributes":{},"resource_attributes":{},"trace_id":"","span_id":"","trace_flags":0,"observed_timestamp_nanos":1776340800000000000,"severity_number":9,"dropped_attributes_count":0,"resource_dropped_attributes_count":0,"scope_name":"","scope_version":"","scope_attributes":{},"scope_dropped_attributes_count":0}
{"timestamp_nanos":1776340860000000000,"severity_text":"ERROR","body":{"message":"Checkout failed"},"service_name":"frontend","attributes":{},"resource_attributes":{},"trace_id":"","span_id":"","trace_flags":0,"observed_timestamp_nanos":1776340860000000000,"severity_number":17,"dropped_attributes_count":0,"resource_dropped_attributes_count":0,"scope_name":"","scope_version":"","scope_attributes":{},"scope_dropped_attributes_count":0}
EOF
Logwiz authenticates the request, checks the token’s index allowlist, and forwards it to Quickwit. Logwiz does not rewrite the request body, so send the format your Quickwit index expects — typically NDJSON with Content-Type: application/x-ndjson. The ?commit=wait_for parameter tells Quickwit to index the documents before returning, so the logs are immediately searchable. Omit it to use Quickwit’s default asynchronous commit.