Skip to main content
obsidianlog query --format raw emits NDJSON: one JSON object per line, the original ingested event, unmodified. Mainstream SIEM tooling ingests this natively:
Run this on a schedule (cron, a systemd timer) for ongoing export. A one-off query run is a snapshot of what matched at that moment, not a live tail of new archives as they land.
This is an example, not a shipped integration. See the config files’ own comments for what to change before using them for real (endpoints, index names, credentials).

​
Filebeat → Elasticsearch/Logstash

A filestream input tails the exported file and parses each line as NDJSON. No custom Filebeat processors are needed, since the shape is already flat JSON per line:
Full config, including the Logstash-output alternative: examples/integrations/siem/filebeat.yml.

​
Splunk

A monitor:// stanza with INDEXED_EXTRACTIONS = json tells Splunk to parse each line as a JSON event directly:
Full config: examples/integrations/siem/splunk-inputs.conf. Drop it into $SPLUNK_HOME/etc/apps/<your_app>/local/inputs.conf and restart the forwarder/instance.

​
Why this needs no custom integration code

--format raw’s output is exactly the log event as it was originally ingested. SIEM tools that already parse JSON logs (most of them) need nothing ObsidianLog-specific to consume it. The interesting property here isn’t the export format, which is just JSON. It’s that what you’re exporting was tamper-evident and hash-chained the whole time it was archived (obsidianlog verify), unlike logs that only ever lived in a mutable hot-tier index.