Send logs

Sigmatic reads logs through data sources. Each data source names an OpenSearch index pattern and works in one of two modes. In push mode, shippers post logs to Sigmatic, which matches them against deployed rules as they arrive. In pull mode, something else already writes to OpenSearch, and Sigmatic queries those indices every few minutes.

Create a data source in Sigmatic, then copy its index suffix and token from its page.

Push logs over HTTP

Post a JSON array of events, or a single event, to the data source’s queue:

curl -X POST "https://sigmatic.example.com/api/logs/<index-suffix>/queue" \
  -H "Authorization: Bearer <data-source-token>" \
  -H "Content-Type: application/json" \
  -d '[{"@timestamp": "2026-09-28T10:00:00Z", "message": "Accepted password for admin"}]'

Sigmatic answers 202 Accepted straight away and workers process the batch. Send an Idempotency-Key header to make retries safe. Each data source can also restrict which addresses may ship to it.

Shippers inside your network can use the private listener on port 8001 with the same path. With TLS enabled, port 8443 serves the same API over TLS; see Install Sigmatic.

Any shipper that can send HTTP POST requests works: Vector, Fluent Bit, syslog-ng with an HTTP destination, or curl.

Map your fields

Sigma rules name fields such as SourceIp, and your logs name them however the shipper wrote them. A data source’s field mappings connect the two. Pick an ECS or OCSF preset when your logs follow one, let Sigmatic suggest mappings from the fields it has indexed, and check the mapping scorecard for fields your rules need but can’t resolve.