Quickstart

Sign in, create an organization, choose a plan, create a project, send one real log, and ask the Sazabi agent your first question. About 10 minutes.

By the end of this guide you will have a project receiving logs and an answer from the Sazabi agent grounded in a log you sent yourself. It takes about 10 minutes, and the fastest honest path is connecting one real log — so that is what you will do.

Most steps offer two functionally identical paths — the dashboard and the CLI. Pick whichever interface you prefer, step by step; they produce the same result.

Prerequisites

A Sazabi account.
A terminal with curl for the one-event path below. If you would rather wire up a real source, the OpenTelemetry option needs an application you can add the SDK to.
For the CLI path: Node.js, to install the CLI with npm install -g @sazabi/cli@latest or run it without installing as npx @sazabi/cli@latest <command>. Keep @latest: without it, npx can reuse an older cached copy that lacks newer commands and flags, such as start --agent. The CLI steps below write sazabi; with npx, type npx @sazabi/cli@latest in its place.

sazabi auth sign-in   # opens your browser for a device-code sign-in
sazabi auth whoami    # confirms who you are signed in as

No account yet? sazabi auth sign-up creates one in the browser.

To run the CLI where nobody can sign in, such as CI or a headless agent, see Running without a browser once your project exists.

Create your organization

Your organization is the shared space for your team, projects, and data.

On the welcome screen, start the setup flow and enter a name for your organization.
Click Continue.

You should land on the plan step. If a teammate already invited you to an organization, you will be prompted to accept the invite first instead.

sazabi organizations create --name "Acme"   # creates the organization and makes it the active one

If you already belong to an organization, select it instead with sazabi organizations use <org-id>. Run sazabi organizations list if you need the ID.

Choose a plan

Your first project needs a paid plan, so choose one before you create it.

On the Choose a plan step, pick a plan.
Pay on the secure checkout page. When payment completes, click Continue to go on to project setup.

sazabi billing plans list                                     # every plan with its price
sazabi billing plans subscribe --plan <plan> --yes --no-wait  # prints a checkout link

Use a plan slug from the list for <plan>. The subscribe command prints a secure checkout link, opens it in your browser when it can, and returns; pay on that page. --yes skips the terminal's confirmation prompt, which a script or coding agent cannot answer; you still review the price on the checkout page before you pay.

Create your project after you've paid: until checkout completes, sazabi projects create asks you to choose a plan first.

Create your project

A project isolates one application or environment's telemetry.

Choose the region where your project's data is stored. If you are unsure, keep the default (US West 2, us-west-2).
Click Continue to create the project.

sazabi projects create --name "Quickstart"   # add --region eu-central-1 to pick a region
sazabi projects use "<project-id>"           # set it as the active project for later commands

Run sazabi projects list if you need the project ID.

Sazabi stores your logs in managed storage for this project — there is no storage backend to configure.

Running without a browser

Once your project exists, CI, scripts, and headless agents can skip sazabi auth sign-in. Set SAZABI_TOKEN to a secret key, or pass the key with --token on each command, and set SAZABI_PROJECT_ID to your project's ID. Create the key at Settings > Secret keys or, while signed in, with sazabi secret-keys create "<name>". The CLI commands in the rest of this guide then run with no sign-in:

export SAZABI_TOKEN="<your secret key>"
export SAZABI_PROJECT_ID="<project-id>"
sazabi log-sources list

A secret key belongs to an organization that already exists, so creating the organization and choosing a plan still need you signed in. Keep the key in a secrets manager and never commit it.

Connect your first log source

You have two ways in. Send one test event by hand to see data land immediately, or set up OpenTelemetry for a real, continuous source.

Recommended: send one test event with curl. It proves the whole path end to end in under a minute, with nothing to install. Use OpenTelemetry instead when you want a real source flowing right away and you already run an app you can instrument. Trade-offs: the curl event is a single record you send once; OpenTelemetry is a continuous stream but takes a few minutes to wire up. Do not use the curl path as your long-term ingestion — it is a smoke test, not a source.

Get your intake URL

Go to Settings > Log streams.
Open your log source and copy the Intake URL from its setup screen. Each log source has its own intake URL, and the URL authenticates the request on its own — you copy the whole URL, and there is no separate key or header to send.

sazabi log-sources create otel --mode manual provisions a manual OpenTelemetry log source and prints its intake URL (the endpoint you point your sender at):

sazabi log-sources create otel --mode manual       # creates the log source and prints its intake URL

The command prints the endpoint under "Point your sender at:" — use that value as SAZABI_INTAKE_URL below.

Keep the intake URL handy for the next step.

Send one test event with curl

Send a single OpenTelemetry-format log record to your log source's intake endpoint. Replace SAZABI_INTAKE_URL with the intake URL you copied plus the /v1/logs path. The intake URL authenticates on its own, so there is no Authorization header to send.

export SAZABI_INTAKE_URL="<your intake URL>/v1/logs"

curl -X POST "$SAZABI_INTAKE_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "resourceLogs": [{
      "resource": { "attributes": [
        { "key": "service.name", "value": { "stringValue": "quickstart" } }
      ]},
      "scopeLogs": [{
        "logRecords": [{
          "severityText": "INFO",
          "body": { "stringValue": "sazabi quickstart test event 8842" }
        }]
      }]
    }]
  }'

You should get an HTTP 200 with {"success":true,...}. A 200 means the envelope was accepted — you will confirm the record actually landed in the Verify step below, because acceptance alone does not guarantee a queryable record.

Set up OpenTelemetry

To send from a real application instead, point your OpenTelemetry exporter at your log source's intake URL — the same one from Settings > Log streams — with no headers needed:

export OTEL_EXPORTER_OTLP_ENDPOINT="<your intake URL>"
export OTEL_EXPORTER_OTLP_PROTOCOL="http/protobuf"

Set OTEL_EXPORTER_OTLP_ENDPOINT to the unsuffixed base — the SDK appends /v1/logs and /v1/traces for you. Sazabi's OTLP intake is HTTP-only, so http/protobuf is required (the SDK default of gRPC will not connect).

For the full per-language SDK walkthrough (Node.js, Python, Go, Java, .NET, and more), see OpenTelemetry log source.

When to use a different source

Many platforms have a one-click Connect your account path — you authorize the account and Sazabi runs the forwarding for you (for example AWS CloudWatch, Google Cloud, Vercel, Sentry). Others send to an endpoint like the one above (Fluent Bit, Vector, Datadog Agent). See Choosing a path and Log source catalog for the full list.

Ask your first question

Open your project in the dashboard and start a thread. Ask the agent about the event you sent:

Find the log with body "sazabi quickstart test event 8842" and tell me its service and severity.

The Sazabi agent searches your logs, and answers with the record it found — showing the query it ran so you can verify it.

Verify

Confirm your test event is queryable and the agent can find it. New logs are normally searchable within a minute or two of acceptance.

In a thread, ask: Show me the log with body "sazabi quickstart test event 8842".
The agent returns one matching record with service.name = quickstart and severity INFO, and shows the log-search query it ran.

You can also confirm from the CLI without opening a thread — sazabi logs ask answers the same question directly:

sazabi logs ask 'Show the log with body "sazabi quickstart test event 8842"' --since 1h

The answer reports one matching line, and the results show it with service quickstart and severity INFO.

If neither the agent nor sazabi logs ask finds the log after a couple of minutes, the record was not ingested. Re-check that you copied the full intake URL, confirm the curl returned 200, and see Troubleshooting ingestion.