The Keep sink enables worker to deliver log events to Keep, allowing logs to be forwarded to Keep’s alerting and event ingestion endpoints. This sink is designed for environments that require external alert correlation or log-driven incident workflows.

The sink operates in batch mode, aggregating log events before transmission to improve delivery efficiency.

Before configuring the Keep sink, ensure the following prerequisites are met:

The API key is used to authenticate worker against the Keep ingestion service. This value must be kept secure and should be managed using environment variables or a secret management system.

The endpoint defines the HTTP destination where log events are delivered. If not explicitly set, the default Keep event ingestion endpoint is used.

Typical use cases for custom endpoints include:

The Keep sink supports event batching to optimize throughput and reduce request overhead.

Batching behavior can be controlled by:

Batching is especially recommended for high-volume log streams.

The sink supports both in-memory and disk-based buffering strategies.

Buffer limits can be defined to control memory or disk usage and to apply backpressure or dropping behavior when limits are reached.

The Keep sink allows preprocessing of events before transmission:

This is useful for:

Outbound traffic to Keep can be routed through HTTP or HTTPS proxies.

Proxy configuration supports:

The sink supports advanced request handling options to improve delivery stability under load or partial failures, including:

These controls help ensure stable operation when sending events to Keep under variable network or service conditions.

The Keep sink is commonly used in scenarios such as: