Struct LogShipCfg 

pub struct LogShipCfg {
    pub enabled: bool,
    pub url: String,
    pub headers: Vec<(String, String)>,
    pub batch: usize,
    pub interval_secs: u64,
    pub queue_size: usize,
}

[log.ship] — stream the access log off the box to a collector.

The edge writes one structured line per request to stdout and, until this existed, nowhere else: an operator running a fleet had to collect logs per box with whatever their platform provided.

Any collector that accepts an NDJSON POST works — Vector, Loki, Splunk HEC, Datadog, an S3 writer, your own receiver. One wire shape rather than an integration per vendor, matching the control plane’s [audit.ship].

This is best-effort, and that is deliberate. [audit.ship] is at-least-once with a cursor because the audit trail is evidence. Access logs are telemetry at three to five orders of magnitude more volume, and guaranteeing delivery would need an unbounded on-box buffer — whose failure mode is that a collector outage takes down the proxy. Records are dropped when the queue fills, and every drop is counted (edgeguard_logship_dropped_total).

Fields

enabled: bool

url: String

Collector URL. Empty disables shipping regardless of enabled.

headers: Vec<(String, String)>

Extra headers, typically the collector’s API key: Authorization: Splunk <token>, DD-API-KEY: <key>. A list of pairs rather than a map so the order is stable in config.

batch: usize

Records per POST.

interval_secs: u64

Flush a partial batch after this many seconds, so a low-traffic edge does not hold its last records indefinitely — a gap in the collector looks exactly like an outage.

queue_size: usize

In-memory queue between the request path and the shipper. This is the bound: past it, records are dropped rather than the request path blocking.

10k at the measured request rates is a few seconds of buffer, which covers a collector restart and not a collector outage. Raising it trades memory for a longer outage tolerated; it does not make delivery guaranteed, and nothing here should be read as if it did.

Trait Implementations

impl Clone for LogShipCfg

fn clone(&self) -> LogShipCfg

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LogShipCfg

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LogShipCfg

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for LogShipCfg

where LogShipCfg: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.