Sources

Sources are where data enters Tell’s pipeline. SDKs, HTTP clients, and syslog daemons connect to sources, which batch incoming data and pass it to routing and sinks. Most setups need just the TCP source — it handles SDK traffic at up to 64M events/sec with zero configuration beyond the port.

Which source to use

Source	Default Port	Auth	Best for
TCP	50000	API key	Native SDKs (Go, Swift, Flutter, C++) — binary Tell protocol, highest throughput
HTTP	8080	API key	JavaScript SDK, web apps — JSONL and binary support
Syslog	514	None	Infrastructure logs from servers, routers, firewalls
File	—	None	One-time imports, replaying exports, ingesting log files from disk

Starting out? Use the TCP source. It’s the default for all native SDKs. Add HTTP if you have browser clients. Add Syslog when you want infrastructure logs alongside product events. Use File for one-time data imports or replaying exported data. You can run multiple sources at once — they all feed into the same pipeline. Configure routing to control which sources send data to which sinks.

Throughput

Benchmarked on Apple M4 Pro, 12 cores, 5 clients, null sink:

Source	Batch 500	Batch 100	Batch 10
TCP Binary	64M/s	55M/s	6.9M/s
HTTP FlatBuffers	24M/s	8.3M/s	1.0M/s
HTTP JSON	2.1M/s	2.3M/s	848K/s
Syslog TCP	8.7M/s	8.5M/s	8.3M/s

Monitoring

Check source health with tell status:

$ tell status
Sources:
  tcp (port 50000)      12 connections   4.2M events   1.8 GB   0 errors
  http (port 8080)       3 connections   128K events   42 MB    0 errors
  syslog_udp (port 514)  4 workers       890K packets  320 MB   2 dropped

Key metrics: active connections, events received, bytes, errors, auth failures (TCP/HTTP), and dropped messages (syslog).

Getting Started

Tracking

Pipeline

Analytics

Installing

Which source to use

Throughput

Monitoring

​Which source to use

​Throughput

​Monitoring

Which source to use

Throughput

Monitoring