Skip to main content

Integrate event data sources

AI summary
Explains how to choose between transport and event source integrations in Imply Lumi. Transport integrations let you control event delivery but require pipeline setup. Event source integrations provide preconfigured parsing for specific log types.

About AI summaries.

Imply Lumi offers a variety of ingestion integrations to help you send data. You can choose an integration based on the following:

  • Transport integration: How you want to send your event data, such as HTTPS/HEC or S3 pull.
  • Event source integration: What kind of data you want to send, such as VPC flow logs.

The following diagram shows the two paths your events can take into Lumi.

Event data sources process flow

With a transport integration, you choose how to send events, and you may need to set up your own pipeline to parse them. The topics in Send events describe how to configure an integration based on the transport mechanism. Both paths produce user attributes you can search.

With an event source integration, you choose the log type and configure a receiver. Lumi assigns the default source type and parses events with the analogous predefined pipeline.

An event source integration offers the most common transport mechanisms for its log type. If you don't see your transport mechanism, you can use a transport integration instead: the predefined pipeline still processes your events as long as they have the matching source type.

For a list of event source integrations, see Event source integrations reference.

Learn more​

See the following topics for more information: