Module logship 

Access-log shipping — the edge’s half of the centralized log plane.

What was missing

The edge emits one structured access-log line per request, to stdout, and that was the whole story. There was no sink, no transport and no destination: an operator running a fleet had to collect logs per box, out of band, with whatever their platform happened to provide. For a product whose pitch is centralized control of an edge fleet, that is the gap.

Why it ships to a collector rather than to the control plane

Two shapes were possible. The control plane could grow a log-ingest endpoint and own the data; or the edge could ship to a collector the operator already runs. This is the second, and the reason is volume: access logs are three to five orders of magnitude more records than the usage deltas the control plane meters. Putting them through the same Postgres that holds invoices would make that store’s dominant workload the one thing nobody bills for.

Shipping to any NDJSON collector — Vector, Loki, Splunk HEC, Datadog, an S3 writer — means the operator keeps the data on their own retention and their own bill, which is also what a self-hosted enterprise customer wants. It reuses the wire shape the control plane’s [audit.ship] already established: one POST of newline-delimited JSON, not an SDK per vendor.

This is NOT the audit trail, and the difference is deliberate

[audit.ship] in the control plane is at-least-once with a cursor: the audit trail is evidence, and a lost record is a hole in it. Access logs are telemetry. Guaranteeing delivery here would mean an unbounded on-box buffer, and the failure mode of an unbounded buffer on a proxy is that a collector outage takes down the proxy — trading a real outage for a telemetry gap. So this is best-effort and bounded, and it counts precisely what it drops.

It must never slow down a request

The request path does one try_send on a bounded channel and returns. It never awaits, never blocks, never allocates a batch and never touches the network. Everything else happens on a background task. If the channel is full — the collector is slow or gone — the record is dropped and counted, which is the same fail-static discipline the control-plane client uses: degrade the telemetry, never the traffic.

Structs

AccessRecord

One access-log record on the wire.

LogShipper

The handle the request path holds. Cloneable, cheap, and non-blocking to use.

ShipStats

Counters for the shipper itself.

Functions

spawn

Build the shipper and spawn its background task. None when shipping is disabled.