Log Forwarder Inputs

Runs the 10x Engine as a forwarder sidecar to process collected log events before they ship to output destinations (e.g., Splunk, Elasticsearch, S3).

The design enables 10x apps — the Reporter (DaemonSet alongside the forwarder) and the Receiver (sidecar, Filter and Compact modes) — to process events at the source while integrating with existing log forwarders (e.g., Fluentd/Bit).

Extensibility

All forwarder input modules utilize core IPC I/O modules (e.g., stdin, Unix) as building blocks for integrating with bundled forwarders (e.g., Fluentd/Bit) and to serve as a reference for supporting additional forwarder types.

Modules

• Fluent Bit

  ---

  Receive and optimize events collected by Fluent Bit via the Fluent Forward protocol.

  More info

• Fluentd

  ---

  Receive and optimize events collected by Fluentd via the Fluent Forward protocol.

  More info

• OpenTelemetry Collector

  ---

  Receive and optimize events collected by the OpenTelemetry Collector via OTLP/gRPC (both directions).

  More info

• Vector

  ---

  Receive and optimize events collected by Vector via the socket sink and fluent source.

  More info

• Filebeat

  ---

  Report, receive, and optimize events collected by Filebeat forwarders.

  More info

• Logstash

  ---

  Receive and optimize events collected by Logstash via newline-delimited JSON.

  More info

• Splunk UF Input

  ---

  Receive and optimize events before shipping to Splunk via Universal Forwarder.

  More info

• Datadog Agent Input

  ---

  Receive and optimize events before shipping to Datadog via Datadog Agent.

  More info

Config Files

To configure the Log Forwarder inputs module, Edit these files.

Below is the default configuration from: forwarder/config.yaml.

Edit Online Edit Locally

Edit config.yaml Locally

Download and save to:

• Linux / Docker / macOS
• Custom directory
  $TENX_CONFIG/run/input/forwarder/config.yaml
• Within cloned repo
  ./pipelines/run/input/forwarder/config.yaml

Download

# 🔟❎ 'run' shared forwarder configuration
#
tenx: run

# =============================== Dependencies ================================

include:

  # Shared forwarder options (mode dispatch, output encoding)
  - run/modules/input/forwarder/module.yaml

# =============================== Mode Options ================================
#
# The Receiver app picks the encoding mode based on user flags:
#   default                      → emit events verbatim (`fullText`)
#   receiverOptimize=true        → compact-all (lossless compaction of every event)
#   compactReceiverLookupFile=…  → compact-lookup (per-pattern decision)
#
output:
  encodeField: $=yield TenXReceiver.encodeField()
  writeTemplates: $=yield TenXReceiver.writeTemplates()

Options

Specify the options below to configure the Log Forwarder inputs:

Name	Description
outputEncodeField	The single field expression each forwarder's output stream writes per event
outputWriteTemplates	Whether the forwarder emits new TenXTemplates alongside encoded events

outputEncodeField

The single field expression each forwarder's output stream writes per event.

Type	Default
String	fullText

Selected per forwarder mode by the user-facing config.yaml:

• receive (default): fullText — plain passthrough, no encoding
• compact-all: encoded=encode() — every event compacted
• compact-lookup: encoded=shouldEncode() ? encode() : fullText — per-pattern decision via the compactReceiver module (requires compactReceiverLookupFile)

Advanced users can override directly to customize the output field expression.

outputWriteTemplates

Whether the forwarder emits new TenXTemplates alongside encoded events.

Type	Default
String	false

True for encoding modes (compact-all, compact-lookup) so decoders can reconstruct events from templateHash + vars. False for receive mode (no encoding → no templates needed).

This module is defined in forwarder/module.yaml.