> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tell.rs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sources

> How data enters Tell — pick the right source for your use case.

Sources are where data enters Tell's pipeline. SDKs, HTTP clients, and syslog daemons connect to sources, which batch incoming data and pass it to [routing](/pipeline/routing) and [sinks](/pipeline/sinks/overview).

Most setups need just the TCP source — it handles SDK traffic at up to 64M events/sec with zero configuration beyond the port.

## Which source to use

| Source                             | Default Port | Auth    | Best for                                                                         |
| ---------------------------------- | ------------ | ------- | -------------------------------------------------------------------------------- |
| [TCP](/pipeline/sources/tcp)       | 50000        | API key | Native SDKs (Go, Swift, Flutter, C++) — binary Tell protocol, highest throughput |
| [HTTP](/pipeline/sources/http)     | 8080         | API key | JavaScript SDK, web apps — JSONL and binary support                              |
| [Syslog](/pipeline/sources/syslog) | 514          | None    | Infrastructure logs from servers, routers, firewalls                             |
| [File](/pipeline/sources/file)     | —            | None    | One-time imports, replaying exports, ingesting log files from disk               |

**Starting out?** Use the [TCP source](/pipeline/sources/tcp). It's the default for all native SDKs. Add [HTTP](/pipeline/sources/http) if you have browser clients. Add [Syslog](/pipeline/sources/syslog) when you want infrastructure logs alongside product events. Use [File](/pipeline/sources/file) for one-time data imports or replaying exported data.

You can run multiple sources at once — they all feed into the same pipeline. Configure [routing](/pipeline/routing) to control which sources send data to which [sinks](/pipeline/sinks/overview).

## Throughput

Benchmarked on Apple M4 Pro, 12 cores, 5 clients, null sink:

| Source           | Batch 500 | Batch 100 | Batch 10 |
| ---------------- | --------- | --------- | -------- |
| TCP Binary       | 64M/s     | 55M/s     | 6.9M/s   |
| HTTP FlatBuffers | 24M/s     | 8.3M/s    | 1.0M/s   |
| HTTP JSON        | 2.1M/s    | 2.3M/s    | 848K/s   |
| Syslog TCP       | 8.7M/s    | 8.5M/s    | 8.3M/s   |

## Monitoring

Check source health with `tell status`:

```
$ tell status
Sources:
  tcp (port 50000)      12 connections   4.2M events   1.8 GB   0 errors
  http (port 8080)       3 connections   128K events   42 MB    0 errors
  syslog_udp (port 514)  4 workers       890K packets  320 MB   2 dropped
```

Key metrics: active connections, events received, bytes, errors, auth failures (TCP/HTTP), and dropped messages (syslog).