New Relic

About

Forward the logs your New Relic agents already collect into Sazabi. The New Relic infrastructure agent ships logs through a bundled Fluent Bit with New Relic’s output plugin. Change that plugin’s logs endpoint to Sazabi and it sends the same JSON batches here. The Kubernetes logging chart and a standalone Fluent Bit with the newrelic plugin work the same way.

Changing the logs endpoint sends these logs to Sazabi instead of New Relic, not in addition to it.

APM agents can’t send their logs to this source directly. Turn on APM local log decorating so your app’s log lines carry trace.id, span.id, and entity.guid, then forward those log files with the infrastructure agent. New Relic metrics, events, traces, and browser data aren’t supported.

Prerequisites

New Relic infrastructure agent 1.76.2 or later (logging_endpoint was added in 1.76.2), the newrelic-logging Helm chart, or Fluent Bit with New Relic’s newrelic output plugin
Your Sazabi intake URL, shown above. Open the log source and copy the Intake URL from its setup screen (the public key is embedded in the URL)

Set up in the dashboard

Sazabi authenticates with the public key in your intake host, so it ignores the New Relic license key. Keep the agent’s existing license key: the agent still needs a non-empty value to start. In every option below, the logs endpoint is your intake URL followed by /log/v1. Choose the option that matches how you run New Relic.

Option A: Infrastructure agent on a host

Add logging_endpoint to newrelic-infra.yml (/etc/newrelic-infra.yml on Linux):

newrelic-infra.yml

# Keep your existing license_key and other settings.
logging_endpoint: https://<your intake hostname>/log/v1

Replace <your intake hostname> with the hostname from your intake URL shown above (without https://).

Option B: Containerized infrastructure agent

NRIA_LOGGING_ENDPOINT=https://<your intake hostname>/log/v1

Option C: Kubernetes (Helm)

Set the logging chart’s endpoint. Put it under newrelic-logging: in nri-bundle values, or at the top level when you install newrelic-logging on its own:

values.yaml

newrelic-logging:
  endpoint: https://<your intake hostname>/log/v1

Then run helm upgrade with your existing values.

Option D: Fluent Bit with the New Relic plugin

fluent-bit.yaml

pipeline:
  outputs:
    - name: newrelic
      match: "*"
      licenseKey: any-non-empty-value
      endpoint: https://<your intake hostname>/log/v1

In a classic .conf file, set the same licenseKey and endpoint keys on the [OUTPUT] block for newrelic.

Restart the agent

Restart the agent (sudo systemctl restart newrelic-infra on Linux), roll the DaemonSet, or reload Fluent Bit so it picks up the new endpoint.

Hand off the change

If this configuration is version-controlled, commit it on a new branch, push it, and open a pull request. Otherwise apply it directly to the agent. Keep the intake URL in environment variables or a secret store, and commit only configuration that references it.

Set up with the CLI

You can also register the New Relic log source with the Sazabi CLI (installed and authenticated — see CLI reference). Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

sazabi log-sources create new_relic --mode manual

The command prints the intake URL for the new source. Add /log/v1 and set it as the logs endpoint using one of the options above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.

Verify

Restart the agent and write a line to a file it forwards, for example logger "sazabi new relic test" on a host that forwards syslog. Open the Intake page in the Sazabi dashboard and confirm logs from the New Relic source appear within a minute. Each log keeps the fields the agent sends, such as message, timestamp, hostname, filePath, and any trace.id and entity.guid.

Troubleshooting

No logs after restarting — Check the agent log (/var/log/newrelic-infra/newrelic-infra.log) for Fluent Bit output errors. Confirm the endpoint is your intake URL followed by /log/v1. The agent ignores logging_endpoint — Agents older than 1.76.2 don’t have the setting. Run newrelic-infra --version and upgrade. Logs stopped appearing in New Relic — Expected: the endpoint now points at Sazabi. To keep logs in New Relic too, run a second Fluent Bit output for New Relic alongside this one.

Intake

See per-source ingestion volume and health.

Fluent Bit

Forward logs using Fluent Bit’s OpenTelemetry output plugin.

Log sources

Browse the full log source catalog.

Overview

Get started

Guides

Catalogs

Reference

Security & trust

cve.now

About

Prerequisites

Set up in the dashboard

Option A: Infrastructure agent on a host

Option B: Containerized infrastructure agent

Option C: Kubernetes (Helm)

Option D: Fluent Bit with the New Relic plugin

Restart the agent

Hand off the change

Set up with the CLI

Verify

Troubleshooting

Further reading

Intake

Fluent Bit

Log sources

​About

​Prerequisites

​Set up in the dashboard

​Option A: Infrastructure agent on a host

​Option B: Containerized infrastructure agent

​Option C: Kubernetes (Helm)

​Option D: Fluent Bit with the New Relic plugin

​Restart the agent

​Hand off the change

​Set up with the CLI

​Verify

​Troubleshooting

​Further reading

Intake

Fluent Bit

Log sources

About

Prerequisites

Set up in the dashboard

Option A: Infrastructure agent on a host

Option B: Containerized infrastructure agent

Option C: Kubernetes (Helm)

Option D: Fluent Bit with the New Relic plugin

Restart the agent

Hand off the change

Set up with the CLI

Verify

Troubleshooting

Further reading