Fastly

Firetiger ingests Fastly access and edge logs via Fastly’s HTTPS log streaming endpoint. Unlike the Vercel and Cloudflare integrations, Fastly does not have a fixed log shape — you choose what fields to include via Fastly’s format string, and Firetiger infers the schema and stores rows in a table whose name comes from the URL path you point Fastly at.

Prerequisites

  • Owner or Engineer access to the Fastly service you want to send logs from.
  • Your Firetiger ingest credentials. The endpoint, username, and password are visible on the Integrations page in the Firetiger console.

  • A Base64-encoded username:password pair for the Authorization header:

    echo -n "username:password" | base64

    Replace username and password with the values from the Integrations page.

Configure the Fastly HTTPS log endpoint

In the Fastly console, open your service and go to Logging > Create endpoint > HTTPS. Configure the fields below.

URL 

https://ingest.cloud.firetiger.com/datapoints/fastly/logs/{slug}

The trailing {slug} is a subdimension that splits Fastly logs into separate Firetiger tables — datapoints/fastly/logs/{slug}. Pick a slug that matches how you’ll query the data later. Common choices:

  • An environment: production, staging, dev
  • The Fastly service name or shortname
  • The customer-facing hostname, with dots replaced by dashes (e.g. www-example-com)
  • A datacenter or region label

Configure one Fastly HTTPS endpoint per slug — for example one endpoint on the production service pointing at …/datapoints/fastly/logs/production, and another on the staging service pointing at …/datapoints/fastly/logs/staging. Splitting the data across tables keeps your queries simple (filter by table, not by row attribute) and lets retention or compaction policies diverge per environment if you ever need that. If you genuinely want everything in one table, use a single slug like all.

Method, content type, and JSON framing

  • Method: POST
  • Content type: application/json
  • JSON log entry format: Array of JSON (recommended). Newline delimited also works — Firetiger’s ingest accepts both formats.

Authentication

Fastly’s HTTPS endpoint sends a single custom header on every log POST, which is how we pass basic auth:

  • Custom header name: Authorization
  • Custom header value: Basic <base64-credentials> (use the value produced by the base64 command above)

Compression

Optional. The Firetiger ingest endpoint accepts gzip and other Content-Encoding values, so feel free to enable compression for bandwidth-heavy services.

Format string

Pick the fields you want in the table. Set Format version to 2 and use a JSON object for the Format field. A reasonable starting point:

{
  "timestamp": "%{begin:%Y-%m-%dT%H:%M:%S%z}t",
  "client_ip": "%h",
  "method": "%m",
  "url": "%{json.escape(req.url)}V",
  "status": %s,
  "host": "%{json.escape(req.http.host)}V",
  "user_agent": "%{json.escape(req.http.User-Agent)}V",
  "request_time_ms": %{time.elapsed.msec}V,
  "fastly_service_id": "%{json.escape(req.service_id)}V",
  "fastly_pop": "%{json.escape(server.datacenter)}V"
}

Add or remove fields freely — Firetiger infers the schema from whatever JSON Fastly sends. See Fastly’s custom log formats reference for the full set of placeholders and VCL variables.

Note that the table is partitioned by ingest receive time, not by any timestamp inside your JSON payload. Including a timestamp field is still useful — it preserves the edge timestamp for use in queries — but it does not affect how Firetiger lays out the data on disk.

Domain-control challenge

Before activating a new HTTPS endpoint, Fastly issues a GET to /.well-known/fastly/logging/challenge to verify endpoint ownership. Firetiger’s ingest server already serves a wildcard response on that path, so the challenge succeeds automatically and you don’t need to do anything to handle it.

Verifying ingest

Trigger some traffic against the Fastly service. Logs typically appear within a few minutes — Fastly batches them and the Firetiger ingest flushes on its own cadence. Each event is wrapped into a row whose top-level timestamp column is the ingest receive time (used for partitioning) and whose datapoint column is the JSON object you sent. The full table name is the literal URL path you configured — for example datapoints/fastly/logs/production — and you can query it from any of Firetiger’s query interfaces.

This site uses Just the Docs, a documentation theme for Jekyll.