Elastic APM events intake API

The events intake API is what we call the internal protocol that APM agents use to talk to the APM Server. Agents communicate with the Server by sending events — captured pieces of information — in an HTTP request. Events can be:

Each event is sent as its own line in the HTTP request body. This is known as newline delimited JSON (NDJSON).

With NDJSON, agents can open an HTTP POST request and use chunked encoding to stream events to the APM Server as soon as they are recorded in the agent. This makes it simple for agents to serialize each event to a stream of newline delimited JSON. The APM Server also treats the HTTP body as a compressed stream and thus reads and handles each event independently.

See the APM data model to learn more about the different types of events.

APM Server exposes the following endpoints for Elastic APM agent data intake:

Send an HTTP POST request to the APM Server intake/v2/events endpoint:

http(s)://{hostname}:{port}/intake/v2/events

From version 8.5.0 onwards, the APM Server supports asynchronous processing of batches. To request asynchronous processing the async query parameter can be set in the POST request to the intake/v2/events endpoint:

http(s)://{hostname}:{port}/intake/v2/events?async=true

For RUM send an HTTP POST request to the APM Server intake/v3/rum/events endpoint instead:

http(s)://{hostname}:{port}/intake/v3/rum/events

On success, the server will respond with a 202 Accepted status code and no body.

Keep in mind that events can succeed and fail independently of each other. Only if all events succeed does the server respond with a 202.

There are two types of errors that the APM Server may return to an agent:

The APM Server processes events one after the other. If an error is encountered while processing an event, the error encountered as well as the document causing the error are added to an internal array. The APM Server will only save 5 event related errors. If it encounters more than 5 event related errors, the additional errors will not be returned to agent. Once all events have been processed, the error response is sent.

Some errors, not relating to specific events, may terminate the request immediately. For example: IP rate limit reached, wrong metadata, etc. If at any point one of these errors is encountered, it is added to the internal array and immediately returned.

An example error response might look something like this:

{
  "errors": [
    {
      "message": "<json-schema-err>", 
      "document": "<ndjson-obj>" 
    },{
      "message": "<json-schema-err>",
      "document": "<ndjson-obj>"
    },{
      "message": "<json-decoding-err>",
      "document": "<ndjson-obj>"
    },{
      "message": "too many requests" 
    },
  ],
  "accepted": 2320 
}

If you’re developing an agent, these errors can be useful for debugging.

The APM Server uses a collection of JSON Schemas for validating requests to the intake API: