Exec

The Exec source collects observability data by executing a command or process directly on the host system. It captures the process output and converts it into structured observability events that can be processed by the pipeline.

This source is commonly used for:

Exec runs in a sidecar role, meaning it operates alongside the monitored workload or system component.

The Exec source runs external commands using one of two execution modes:

The execution mode determines process lifecycle management, restart behavior, and resource usage characteristics.

Defines the command to execute and its arguments. Each element in the list represents a single argument passed to the process.

This approach avoids shell interpretation issues and ensures predictable execution behavior across environments.

Specifies the directory in which the command is executed. If not set, the command runs in the default working directory of the worker process.

This is useful when executing scripts or binaries that rely on relative paths.

Defines custom environment variables that are set or overridden when executing the command. If a variable already exists in the environment, its value is replaced for the lifetime of the process.

This enables:

When enabled, clears all inherited environment variables before applying the custom environment configuration.

This is typically used for:

Default behavior preserves the existing environment.

Controls whether data written to stderr is captured and emitted as events.

When enabled, both standard output and standard error streams are included, allowing error messages and diagnostic output to be observed alongside normal output.

Defines the maximum amount of buffered output allowed before an event is emitted.

This setting protects the system from excessive memory usage caused by commands that produce large or unbounded output.

In scheduled mode, the command is executed repeatedly at fixed intervals.

scheduled.exec_interval_secs (optional, uint)

Defines the interval between consecutive command executions, in seconds.

In streaming mode, the command is started once and runs continuously until it exits.

This mode is suitable for:

streaming.respawn_on_exit (optional, bool)

Controls whether the command should be automatically restarted after it exits.

streaming.respawn_interval_secs (optional, uint)

Specifies the delay, in seconds, before restarting a command that has exited.

This prevents tight restart loops in the case of failing or misconfigured commands.

Controls how raw process output bytes are interpreted and converted into events.

The Exec source supports a wide range of codecs, allowing output to be parsed into logs, metrics, or traces depending on the selected format.

If no codec is specified, output is treated as raw bytes.

Certain codecs (such as native, native_json, and otlp) are capable of emitting:

The emitted signal type is determined dynamically based on the decoded payload.

Framing defines how the raw byte stream produced by the process is split into individual events.

This is especially important for commands that emit multiple logical events over a single stream.

Each framing method supports optional size limits to prevent unbounded buffering when handling malformed or unexpected output.

The Exec source provides at-least-once delivery, meaning output may be re-emitted if downstream failures occur.

Because acknowledgements are not supported:

The Exec source provides a flexible bridge between process-based tooling and modern observability pipelines.