Data Exporters

Data exporters are the way to export alerts, events, and analytics from Otoroshi to external storage and monitoring systems.

To try them out, you can follow this tutorial.

UI page

You can find all data exporters here

Properties

Property	Type	Default	Description
`id`	string		Unique identifier
`name`	string		Display name
`description`	string		Description
`enabled`	boolean	`true`	Whether the exporter is active
`typ`	string		The type of exporter (see exporter types)
`tags`	array of string	`[]`	Tags
`metadata`	object	`{}`	Key/value metadata
`filtering`	object		Event filtering configuration (see below)
`projection`	object	`{}`	Projection to export only specific fields
`bufferSize`	number	`5000`	Number of events to keep in memory buffer
`jsonWorkers`	number	`1`	Number of workers for JSON serialization
`sendWorkers`	number	`1`	Number of workers for sending events
`groupSize`	number	`100`	Number of events to batch together
`groupDuration`	number	`30000`	Maximum wait time (ms) before sending a batch
`config`	object		Exporter-specific configuration

Matching and projections

Filtering

Filtering is used to include or exclude specific types of events and alerts. Each include/exclude entry is a key-value match.

Example: only keep Otoroshi alerts:

{ "include": [{ "@type": "AlertEvent" }] }

Otoroshi provides rules to filter events based on their content. Given this example event:

{
  "foo": "bar",
  "type": "AlertEvent",
  "alert": "big-alert",
  "status": 200,
  "codes": ["a", "b"],
  "inner": {
    "foo": "bar",
    "bar": "foo"
  }
}

{
  "<key>": "<value>"
}

a field key with value

{
  "foo": "bar"
}

Keep events with foo as key and bar as value

{
  "<key>": {
    "$wildcard": "<value>*"
  }
}

a field starting with value

{
  "type": {
    "$wildcard": "Alert*"
  }
}

Keep events with type field starting with Alert

{
  "<key>": {
    "<key2>": "<value>"
  }
}

a sub-field with value

{
  "inner": {
    "foo": "bar"
  }
}

Keep events with sub field foo at value bar

{
  "<key>": "<number>"
}

a field with the specific value as number

{
  "status": 200
}

Keep events with status code at 200 (as number check)

{
  "<key>": {
    "$gt": "<number>"
  }
}

a field with number value greater than number

{
  "status": {
    "$gt": 100
  }
}

Keep events with status code greater than 100

{
  "<key>": {
    "$gte": "<number>"
  }
}

a field with number value greater or equal to number

{
  "status": {
    "$gte": 100
  }
}

Keep events with status code greater or equal to 100

{
  "<key>": {
    "$lt": "<number>"
  }
}

a field with number value lower than number

{
  "status": {
    "$lt": 100
  }
}

Keep events with status code lower than 100

{
  "<key>": {
    "$lte": "<number>"
  }
}

a field with number value lower or equal to number

{
  "status": {
    "$lte": 100
  }
}

Keep events with status code lower or equal to 100

{
  "<key>": {
    "$between": {
      "min": "<number>",
      "max": "<number>"
    }
  }
}

a field with value between two values (exclusive)

{
  "status": {
    "$between": {
      "min": 100,
      "max": 200
    }
  }
}

Keep events with status code between 100 and 200 (100 and 200 won't match)

{
  "<key>": {
    "$between": {
      "min": "<number>",
      "max": "<number>"
    }
  }
}

a field with value between two values (inclusive)

{
  "status": {
    "$between": {
      "min": 100,
      "max": 200
    }
  }
}

Keep events with status code between 100 and 200 (100 and 200 will match)

{
  "<key>": {
    "$and": [
      {
        "<key2>": "<value>"
      },
      {
        "<key3>": "<value>"
      }
    ]
  }
}

an object with two fields with values

{
  "inner": {
    "$and": [
      {
        "foo": "bar"
      },
      {
        "bar": "foo"
      }
    ]
  }
}

Keep events matching the list of key-value

{
  "$or": [
    {
      "<key2>": "<value>"
    },
    {
      "<key3>": "<value>"
    }
  ]
}

an object matching at least one condition of the list

{
  "$or": [
    {
      "method": "DELETE"
    },
    {
      "protocol": "http"
    }
  ]
}

Keep event whose method is http OR method is DELETE OR both

{
  "$nor": [
    {
      "<key2>": "<value>"
    },
    {
      "<key3>": "<value>"
    }
  ]
}

an object that matches no conditions of the list

{
  "$nor": [
    {
      "method": "DELETE"
    },
    {
      "protocol": "http"
    }
  ]
}

Keep events whose method is not DELETE AND protocol is not http

{
  "<key>": [
    "<value>",
    "<value2>"
  ]
}

an array field with values

{
  "codes": [
    "a",
    "b"
  ]
}

Keep events with an array codes which strictly containing values a and b

{
  "<key>": {
    "$contains": "<value>"
  }
}

an array field containing a specific value

{
  "codes": {
    "$contains": "a"
  }
}

Keep events with an array codes containing an a value

{
  "<key>": {
    "$contains": {
      "key": "<subkey>",
      "value": "<value>"
    }
  }
}

an object containing a key subkey with given value

{
  "target": {
    "$contains": {
      "key": "scheme",
      "value": "https"
    }
  }
}

Keep events whose target contains a field 'scheme' valued to 'https'

{
  "<key>": {
    "$all": [
      "<value>",
      "<value>"
    ]
  }
}

and array field containing all specific values

{
  "codes": {
    "$all": [
      "a",
      "b"
    ]
  }
}

Keep events with an array codes containing at minima a and b values

{
  "<key>": {
    "$regex": "<value>"
  }
}

a string field whose value match given regular expression

{
  "url": {
    "$regex": ".*api.*"
  }
}

Keep events with url containing 'api'

{
  "<key>": {
    "$in": [
      "<value>",
      "<value2>"
    ]
  }
}

a field containing one of the given value

{
  "method": {
    "$in": [
      "PUT",
      "POST"
    ]
  }
}

Keep events whose method is PUT or POST

{
  "<key>": {
    "$nin": [
      "<value>",
      "<value2>"
    ]
  }
}

a field containing none of the given value

{
  "method": {
    "$nin": [
      "PUT",
      "POST"
    ]
  }
}

Keep events whose method is neither PUT nor POST

{
  "<key>": {
    "$size": "<number>"
  }
}

an array field whose size is given value

{
  "headers": {
    "$size": 12
  }
}

Keep events with exactly 12 headers

{
  "<key>": {
    "$not": "<condition>"
  }
}

an object that does not satisfy condition

{
  "url": {
    "$not": {
      "$regex": ".*api.*"
    }
  }
}

Keep events whose url does not contain 'api'

{
  "<key>": {
    "$eq": "<value>"
  }
}

a field key with value

{
  "foo": {
    "$eq": "bar"
  }
}

Keep events with foo as key and bar as value

{
  "<key>": {
    "$ne": "<value>"
  }
}

a field key whose value is not provided value

{
  "foo": {
    "$ne": "bar"
  }
}

Keep events with foo field not equal to bar

{
  "<key>": {
    "$exists": "<entry>"
  }
}

an object field containing given entry as key

{
  "target": {
    "$exists": "scheme"
  }
}

Keep events whose target object contains a schema field

Projection

Projection is a list of fields to export. If empty, all fields are exported. If specified, only the listed fields will be included in exported events.

"<field>": true

Description

{
  "<field>": true
}

Include given field in result.

Expression

{
  "foo": true
}

Event

{
  "headers": [
    {
      "key": 1,
      "value": "1"
    },
    {
      "key": 2,
      "value": "2"
    }
  ],
  "foo": 1
}

Result

{
  "foo": 1
}

$date_from_unix_fmt

Description

{
  "<field>": {
    "$date_from_unix_fmt": {
      "path": "<source>",
      "pattern": "<pattern>"
    }
  }
}

Formats a unix timestamp into a stringified datetime

Expression

{
  "@timestamp": {
    "$date_from_unix_fmt": {
      "path": "@timestamp",
      "pattern": "yyyy-MM-dd'T'HH:mm:ss.SSSZ"
    }
  }
}

Event

{
  "@timestamp": 1764086514458
}

Result

{
  "@timestamp": "2025-11-25T17.00.00.000Z"
}

$at

Description

{
  "<target>": {
    "$at": "<location>"
  }
}

Values <target> with value <at> location

Expression

{
  "h1": {
    "$at": "headers.0.value"
  }
}

Event

{
  "headers": [
    {
      "key": 1,
      "value": "1"
    },
    {
      "key": 2,
      "value": "2"
    }
  ]
}

Result

{
  "h1": "1"
}

$at (with default)

Description

{
  "<target>": {
    "$at": {
      "path": "<location>",
      "default": "<default_value>"
    }
  }
}

Values <target> with value <at> location

Expression

{
  "h1": {
    "$at": {
      "path": "headers.3.value",
      "default": "foo"
    }
  }
}

Event

{
  "headers": [
    {
      "key": 1,
      "value": "1"
    },
    {
      "key": 2,
      "value": "2"
    }
  ]
}

Result

{
  "h3": "foo"
}

$atIf

Description

{
  "<target>": {
    "$atIf": {
      "path": "<path>",
      "predicate": {
        "at": "<at>",
        "value": "<value>"
      },
      "default": "<default_value>"
    }
  }
}

Put <path> value in <target> if value at <at> match <value>

Expression

{
  "r": {
    "$atIf": {
      "path": "hs.0.value",
      "predicate": {
        "at": "scheme",
        "value": "HTTPS"
      }
    }
  }
}

Event

{
  "hs": [
    {
      "key": 1,
      "value": "1"
    },
    {
      "key": 2,
      "value": "2"
    }
  ],
  "scheme": "HTTPS"
}

Result

{
  "r": "1"
}

$pointer

Description

{
  "<target>": {
    "$pointer": "<jsonPointer>"
  }
}

Allow to get a json value using JSON pointer spec. "<jsonPointer>" can be an object with "path" and "default"

Expression

{
  "h1": {
    "$pointer": "/headers/0/value"
  }
}

Event

{
  "headers": [
    {
      "key": 1,
      "value": "1"
    },
    {
      "key": 2,
      "value": "2"
    }
  ]
}

Result

{
  "h1": "1"
}

$pointerIf

Description

{
  "<target>": {
    "$pointerIf": {
      "path": "<path>",
      "predicate": {
        "pointer": "<pointer>",
        "value": "<value>"
      },
      "default": "<default_value>"
    }
  }
}

Put value at <path> in <target> field if and only if value at <pointer> equals <value>. <path> and <pointer> fields are resolved using json pointer spec.

Expression

{
  "h1": {
    "$pointerIf": {
      "path": "/headers/0/value",
      "predicate": {
        "pointer": "/scheme",
        "value": "HTTP"
      }
    }
  }
}

Event

{
  "headers": [
    {
      "key": 1,
      "value": "1"
    },
    {
      "key": 2,
      "value": "2"
    }
  ],
  "scheme": "HTTP"
}

Result

{
  "h1": "1"
}

$path

Description

{
  "<target>": {
    "$path": "<jsonPath>"
  }
}

Put value located at <jsonPath> in <target>. <jsonPath> is resolved using json path specification. "<jsonPath>" can be an object with "path" and "default"

Expression

{
  "hs": {
    "$path": "$.headers[1:]"
  }
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    },
    {
      "key": "k2",
      "value": "v2"
    },
    {
      "key": "k3",
      "value": "v3"
    }
  ]
}

Result

{
  "hs": [
    {
      "key": "k2",
      "value": "v2"
    },
    {
      "key": "k3",
      "value": "v3"
    }
  ]
}

$pathIf

Description

{
  "<target>": {
    "$pathIf": {
      "path": "<jsonPath>",
      "predicate": {
        "path": "<predicateJsonPath>",
        "value": "<value>"
      },
      "default": "<default_value>"
    }
  }
}

Put value located at <jsonPath> in <target>, if and only if value at <predicateJsonPath> equals <value>.

Expression

{
  "test": {
    "$pathIf": {
      "path": "$.headers[1:]",
      "predicate": {
        "path": "$.scheme",
        "value": "HTTPS"
      }
    }
  }
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    },
    {
      "key": "k2",
      "value": "v2"
    },
    {
      "key": "k3",
      "value": "v3"
    }
  ],
  "scheme": "HTTPS"
}

Result

{
  "test": [
    {
      "key": "k2",
      "value": "v2"
    },
    {
      "key": "k3",
      "value": "v3"
    }
  ]
}

$compose (array result)

Description

{
  "<target>": {
    "$compose": [
      {
        "<subtarget>": {
          "$path": "<path>"
        }
      }
    ]
  }
}

Build an array in <target> field, by composing severals operators : $path, $at, $pointer.

Expression

{
  "result": {
    "$compose": [
      {
        "values": {
          "$path": "$.headers[0:].value"
        }
      },
      {
        "keys": {
          "$path": "$.headers[0:].key"
        }
      }
    ]
  }
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    },
    {
      "key": "k2",
      "value": "v2"
    },
    {
      "key": "k3",
      "value": "v3"
    }
  ],
  "scheme": "HTTPS"
}

Result

{
  "result": [
    {
      "values": [
        "v1",
        "v2",
        "v3"
      ]
    },
    {
      "keys": [
        "k1",
        "k2",
        "k3"
      ]
    }
  ]
}

$compose (object result)

Description

{
  "<target>": {
    "$compose": {
      "<subtarget>": {
        "$path": "<path>"
      }
    }
  }
}

Build an object in <target> field, by composing severals operators : $path, $at, $pointer.

Expression

{
  "result": {
    "$compose": {
      "values": {
        "$path": "$.headers[0:].value"
      },
      "keys": {
        "$path": "$.headers[0:].key"
      }
    }
  }
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    },
    {
      "key": "k2",
      "value": "v2"
    },
    {
      "key": "k3",
      "value": "v3"
    }
  ]
}

Result

{
  "result": {
    "values": [
      "v1",
      "v2",
      "v3"
    ],
    "keys": [
      "k1",
      "k2",
      "k3"
    ]
  }
}

$value

Description

{
  "<target>": {
    "$value": "<value>"
  }
}

Put <value> in <target> field. <value> can be either a primitive type, an object or an array.

Expression

{
  "headers": {
    "$value": []
  }
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    },
    {
      "key": "k2",
      "value": "v2"
    },
    {
      "key": "k3",
      "value": "v3"
    }
  ]
}

Result

{
  "headers": []
}

$spread

Description

{
  "$spread": true
}

Include all properties of source object, this can be used as base for further transformation with below operators.

Expression

{
  "$spread": true
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    }
  ],
  "scheme": "HTTPS",
  "foo": 1
}

Result

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    }
  ],
  "scheme": "HTTPS",
  "foo": 1
}

"<field>": false

Description

{
  "$spread": true,
  "<field>": false
}

Exclude <field> field from resulting object

Expression

{
  "$spread": true,
  "foo": false
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    }
  ],
  "scheme": "HTTPS",
  "foo": 1
}

Result

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    }
  ],
  "scheme": "HTTPS"
}

$remove

Description

{
  "$spread": true,
  "<field>": {
    "$remove": true
  }
}

Exclude <field> field from resulting object, like for {"<field>": false}

Expression

{
  "$spread": true,
  "foo": {
    "$remove": true
  }
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    }
  ],
  "scheme": "HTTPS",
  "foo": 1
}

Result

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    }
  ],
  "scheme": "HTTPS"
}

$header

Description

{
  "<target>": {
    "$header": {
      "path": "<path>",
      "name": "<name>",
      "default": "<default_value>"
    }
  }
}

Put specified header value in <target>. <path> indicate an array of key/value headers, <name> indicate the name of the header.

Expression

{
  "hostValue": {
    "$header": {
      "path": "headers",
      "name": "Host"
    }
  }
}

Event

{
  "headers": [
    {
      "key": "Host",
      "value": "otoroshi.oto.tools:9999"
    },
    {
      "key": "Accept",
      "value": "application/json"
    }
  ]
}

Result

{
  "hostValue": "otoroshi.oto.tools:9999"
}

$includeAllKeysMatching

Description

{
  "$spread": true,
  "<subname>": {
    "$includeAllKeysMatching": [
      "<expression>"
    ]
  }
}

Filter an object entries based on StartsWith, Wildcard or Regex expression. A logical OR will be applied between filters.

Expression

{
  "$spread": true,
  "_": {
    "$includeAllKeysMatching": [
      "Wildcard(f*)",
      "StartsWith(fi)",
      "bar",
      "Regex(.*lo)"
    ]
  }
}

Event

{
  "foo": 1,
  "foobar": 2,
  "bar": 3,
  "baz": 4,
  "hello": "world",
  "fifou": "test"
}

Result

{
  "foo": 1,
  "foobar": 2,
  "bar": 3,
  "hello": "world",
  "fifou": "test"
}

$excludeAllKeysMatching

Description

{
  "$spread": true,
  "<subname>": {
    "$excludeAllKeysMatching": [
      "<expression>"
    ]
  }
}

Filter an object entries, excluding them based on StartsWith, Wildcard or Regex expression. A logical OR will be applied between filters.

Expression

{
  "$spread": true,
  "_": {
    "$excludeAllKeysMatching": [
      "Wildcard(fo*)",
      "StartsWith(fi)",
      "bar",
      "Regex(.*lo)"
    ]
  }
}

Event

{
  "foo": 1,
  "foobar": 2,
  "bar": 3,
  "baz": 4,
  "hello": "world",
  "fifou": "test"
}

Result

{
  "baz": 4
}

$jq

Description

{
  "<target>": {
    "$jq": "<jqExpression>"
  }
}

Fill target field with provided JQ selector

Expression

{
  "headerKeys": {
    "$jq": "[.headers[].key]"
  }
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    },
    {
      "key": "k2",
      "value": "v2"
    }
  ]
}

Result

{
  "headerKeys": [
    "k1",
    "k2"
  ]
}

$jqIf

Description

{
  "<target>": {
    "$jqIf": {
      "filter": "<jqExpression>",
      "predicate": {
        "path": "<path>",
        "value": "<value>"
      }
    }
  }
}

Fill target field with provided JQ selector if and only if value located at <path> is equal to <value>

Expression

{
  "headerKeys": {
    "$jqIf": {
      "filter": "[.headers[].key]",
      "predicate": {
        "path": "target.scheme",
        "value": "https"
      }
    }
  }
}

Event

{
  "headers": [
    {
      "key": "k1",
      "value": "v1"
    },
    {
      "key": "k2",
      "value": "v2"
    }
  ],
  "target": {
    "scheme": "https"
  }
}

Result

{
  "headerKeys": [
    "k1",
    "k2"
  ]
}

Exporter types

Elastic

Sends events in batch to an Elasticsearch cluster. Can be used with the elastic analytics dashboard.

Property	Type	Description
`uris`	array of string	Elasticsearch cluster URIs
`index`	string	Index name
`type`	string	Event type (not needed for ES 6.x+)
`user`	string	Username (optional)
`password`	string	Password (optional)
`version`	string	Elasticsearch version (auto-detected if not set)
`applyTemplate`	boolean	Automatically apply index template
`indexSettings.clientSide`	boolean	Otoroshi manages index creation over time
`indexSettings.interval`	string	Index rotation interval: `Day`, `Week`, `Month`, or `Year`
`indexSettings.numberOfShards`	number	Number of shards
`indexSettings.numberOfReplicas`	number	Number of replicas
`mtlsConfig`	object	Custom TLS settings

Webhook

Sends events in batch to an HTTP endpoint using POST with a JSON array body.

Property	Type	Description
`url`	string	URL to post events to
`headers`	object	HTTP headers to include
`tlsConfig`	object	Custom TLS settings

Kafka

Sends events to an Apache Kafka topic. See Kafka tutorials.

Property	Type	Description
`servers`	array of string	Kafka broker addresses
`topic`	string	Kafka topic name
`sasl`	object	SASL authentication (username, password, mechanism: `PLAIN`/`SCRAM-SHA-256`/`SCRAM-SHA-512`)
`keypass`	string	Keystore password
`keystore`	string	Keystore path
`truststore`	string	Truststore path
`tlsConfig`	object	Custom TLS settings

Pulsar

Sends events to an Apache Pulsar topic.

Property	Type	Description
`uri`	string	Pulsar server URI
`tenant`	string	Pulsar tenant
`namespace`	string	Pulsar namespace
`topic`	string	Pulsar topic
`tlsConfig`	object	Custom TLS settings

Splunk

Sends events to a Splunk HTTP Event Collector (HEC).

Property	Type	Description
`url`	string	Splunk HEC URL
`token`	string	HEC token
`index`	string	Splunk index (optional)
`type`	string	Event source type (optional)
`headers`	object	Additional HTTP headers
`tlsConfig`	object	Custom TLS settings

Datadog

Sends events to Datadog via the Datadog API.

Property	Type	Description
`host`	string	Datadog API host (e.g., `https://api.datadoghq.eu`)
`apiKey`	string	Datadog API key
`applicationKey`	string	Application key (optional)
`headers`	object	Additional HTTP headers
`tlsConfig`	object	Custom TLS settings

New Relic

Sends events to New Relic via their API.

Property	Type	Description
`url`	string	New Relic API URL
`licenseKey`	string	New Relic license key
`accountId`	string	New Relic account ID
`headers`	object	Additional HTTP headers
`tlsConfig`	object	Custom TLS settings

File

Writes events to local files.

Property	Type	Description
`path`	string	File path to write events
`maxFileSize`	number	Maximum file size in bytes. When reached, a new timestamped file is created
`maxNumberOfFile`	number	Maximum number of files to retain

S3

Writes events to an S3-compatible object store.

Property	Type	Description
`maxFileSize`	number	Maximum size per file
`maxNumberOfFile`	number	Maximum number of files
`config`	object	S3 configuration (bucket, region, credentials, endpoint)

GoReplay file

Writes events in .gor format compatible with GoReplay.

warning

This exporter only catches TrafficCaptureEvent. These events are generated when a route has the capture flag enabled. See engine docs.

Property	Type	Description
`path`	string	File path
`maxFileSize`	number	Maximum file size
`captureRequests`	boolean	Capture HTTP requests
`captureResponses`	boolean	Capture HTTP responses

GoReplay S3

Same as GoReplay file but writes to an S3-compatible store.

Property	Type	Description
`s3`	object	S3 configuration
`maxFileSize`	number	Maximum file size
`captureRequests`	boolean	Capture HTTP requests
`captureResponses`	boolean	Capture HTTP responses
`preferBackendRequest`	boolean	Prefer backend request over client request
`preferBackendResponse`	boolean	Prefer backend response over client response
`methods`	array of string	HTTP methods to capture

TCP

Sends events over raw TCP connections.

Property	Type	Description
`host`	string	Target host
`port`	number	Target port
`unixSocket`	string	Unix socket path (alternative to host/port)
`connectTimeout`	number	Connection timeout (ms)
`tls`	object	TLS configuration

UDP

Sends events over UDP.

Property	Type	Description
`host`	string	Target host
`port`	number	Target port
`unixSocket`	string	Unix socket path (alternative to host/port)
`connectTimeout`	number	Connection timeout (ms)

Syslog

Sends events to a syslog server.

Property	Type	Description
`host`	string	Syslog server host
`port`	number	Syslog server port
`protocol`	string	Protocol: `tcp` or `udp`
`unixSocket`	string	Unix socket path
`connectTimeout`	number	Connection timeout (ms)
`tls`	object	TLS configuration (for TCP)

JMS

Sends events to a JMS (Java Message Service) queue or topic.

Property	Type	Description
`url`	string	JMS connection URL
`name`	string	Queue/topic name
`topic`	boolean	If `true`, sends to a topic; otherwise to a queue
`username`	string	JMS username
`password`	string	JMS password

PostgreSQL

Writes events to a PostgreSQL database.

Property	Type	Description
`uri`	string	Full connection URI (alternative to individual fields)
`host`	string	Database host
`port`	number	Database port
`database`	string	Database name
`user`	string	Username
`password`	string	Password
`schema`	string	Schema name
`table`	string	Table name
`poolSize`	number	Connection pool size
`ssl`	boolean	Enable SSL

Workflow

Routes events to an Otoroshi workflow for custom processing.

Property	Type	Description
`ref`	string	Workflow ID to invoke

Console

Writes events to the standard output. No additional configuration needed.

WASM

Processes events through a WebAssembly plugin.

Property	Type	Description
`wasmRef`	string	Reference to a WASM plugin entity
`params`	object	Additional parameters passed to the WASM function

OTLP Metrics

Exports metrics using the OpenTelemetry Protocol (OTLP).

Property	Type	Description
`otlp`	object	OTLP endpoint configuration (URL, headers, protocol)
`tags`	object	Custom metric tags/labels
`metrics`	array of object	Metric definitions to export

OTLP Logs

Exports logs using the OpenTelemetry Protocol (OTLP).

Property	Type	Description
`otlp`	object	OTLP endpoint configuration (URL, headers, protocol)

Custom Metrics

Exposes custom metrics on the /metrics endpoint.

Property	Type	Description
`tags`	object	Custom metric labels
`metrics`	array of object	Metric definitions

Metrics

Rewrites metric labels exposed on the /metrics endpoint.

Property	Type	Description
`labels`	object	Map of existing label names to new label names

Mailer

Sends events as email using one of the following providers:

Console mailer

Writes emails to the standard output (for testing).

Generic mailer

Property	Type	Description
`url`	string	URL to push events
`headers`	object	HTTP headers
`to`	array of string	Recipient email addresses

Mailgun

Property	Type	Description
`eu`	boolean	Use EU server (`api.eu.mailgun.net`) instead of US
`apiKey`	string	Mailgun API key
`domain`	string	Mailgun domain
`to`	array of string	Recipient email addresses

Mailjet

Property	Type	Description
`publicKey`	string	Mailjet public API key
`privateKey`	string	Mailjet private API key
`to`	array of string	Recipient email addresses

Sendgrid

Property	Type	Description
`apiKey`	string	Sendgrid API key
`to`	array of string	Recipient email addresses

Custom exporter

Allows using a custom exporter plugin. Create a plugin of type "exporter" on the plugins page, then select it here.

Property	Type	Description
`ref`	string	Reference to the custom exporter plugin
`config`	object	Exporter configuration

Admin API

GET    /api/data-exporter-configs           # List all data exporters
POST   /api/data-exporter-configs           # Create a data exporter
GET    /api/data-exporter-configs/:id       # Get a data exporter
PUT    /api/data-exporter-configs/:id       # Update a data exporter
DELETE /api/data-exporter-configs/:id       # Delete a data exporter
PATCH  /api/data-exporter-configs/:id       # Partially update a data exporter

UI page​

Properties​

Matching and projections​

Filtering​

Projection​

"<field>": true

Description

Expression

Event

Result

$date_from_unix_fmt

Description

Expression

Event

Result

$at

Description

Expression

Event

Result

$at (with default)

Description

Expression

Event

Result

$atIf

Description

Expression

Event

Result

$pointer

Description

Expression

Event

Result

$pointerIf

Description

Expression

Event

Result

$path

Description

Expression

Event

Result

$pathIf

Description

Expression

Event

Result

$compose (array result)

Description

Expression

Event

Result

$compose (object result)

Description

Expression

Event

Result

$value

Description

Expression

Event

Result

$spread

Description

Expression

Event

Result

"<field>": false

Description

Expression

Event

Result

$remove

Description

Expression

Event

Result

UI page

Properties

Matching and projections

Filtering

Projection

Exporter types

Elastic

Webhook

Kafka

Pulsar

Splunk

Datadog

New Relic

File

S3

GoReplay file

GoReplay S3

TCP

UDP

Syslog

JMS

PostgreSQL

Workflow

Console

WASM

OTLP Metrics

OTLP Logs

Custom Metrics

Metrics

Mailer

Console mailer

Generic mailer

Mailgun

Mailjet

Sendgrid

Custom exporter

Admin API