Skip to main content
Sources are where data enters Tell’s pipeline. SDKs, HTTP clients, and syslog daemons connect to sources, which batch incoming data and pass it to routing and sinks. Most setups need just the TCP source — it handles SDK traffic at up to 64M events/sec with zero configuration beyond the port.

​
Which source to use

SourceDefault PortAuthBest for
TCP50000API keyNative SDKs (Go, Swift, Flutter, C++) — binary Tell protocol, highest throughput
HTTP8080API keyJavaScript SDK, web apps — JSONL and binary support
Syslog514NoneInfrastructure logs from servers, routers, firewalls
File—NoneOne-time imports, replaying exports, ingesting log files from disk
Starting out? Use the TCP source. It’s the default for all native SDKs. Add HTTP if you have browser clients. Add Syslog when you want infrastructure logs alongside product events. Use File for one-time data imports or replaying exported data. You can run multiple sources at once — they all feed into the same pipeline. Configure routing to control which sources send data to which sinks.

​
Throughput

Benchmarked on Apple M4 Pro, 12 cores, 5 clients, null sink:
SourceBatch 500Batch 100Batch 10
TCP Binary64M/s55M/s6.9M/s
HTTP FlatBuffers24M/s8.3M/s1.0M/s
HTTP JSON2.1M/s2.3M/s848K/s
Syslog TCP8.7M/s8.5M/s8.3M/s

​
Monitoring

Check source health with tell status: 
$ tell status
Sources:
  tcp (port 50000)      12 connections   4.2M events   1.8 GB   0 errors
  http (port 8080)       3 connections   128K events   42 MB    0 errors
  syslog_udp (port 514)  4 workers       890K packets  320 MB   2 dropped
Key metrics: active connections, events received, bytes, errors, auth failures (TCP/HTTP), and dropped messages (syslog).