Skip to content

Send Your First Data

Creating a feed and posting a file to it, then finding the stream that resulted.

Everything in Stroom starts with data arriving on a feed. A feed is a named channel, and it is also a security boundary: permissions and retention are set on it. For now, create one and send it a file.

Create the feed

In the explorer tree, right-click a folder and choose New > Data Processing > Feed. Call it TEST-EVENTS.

Feed names must be upper case letters, digits, hyphens and underscores, at least three characters long. Stroom does not convert a name for you: the dialog rejects anything else, such as test-events, with an Invalid name message. The Feed header on a post is matched exactly too, so a sender that writes test-events does not reach TEST-EVENTS. See Choosing a feed.

The feed exists as soon as the dialog closes, and can receive data straight away. On the feed's Settings tab, leave the defaults. Check that Feed Status is Receive.

Get an API key

By default Stroom only accepts data from a sender it can identify, by an API key or a client certificate. A post with neither is refused with 401.

From the main menu choose Security > Manage API Keys, and create a key for your own user. The new key is shown once, in the dialog that creates it. Copy it then: you cannot view it again afterwards. See API keys.

The stroom_core_test stack has receipt authentication turned off (receive.authenticationRequired set to false), so on it the key is optional and you can leave out the Authorization header below. On a default Stroom you need it.

Send it something

Make a small CSV file:

cat > sample.csv <<'EOF'
time,user,action,ip
2026-10-13T09:15:00.000Z,alice,login,192.168.1.10
2026-10-13T09:15:04.000Z,bob,login,192.168.1.11
2026-10-13T09:16:22.000Z,alice,download,192.168.1.10
EOF

Post it:

curl -k -v -X POST "https://localhost/stroom/datafeeddirect" \
  -H "Authorization: Bearer <your API key>" \
  -H "Feed: TEST-EVENTS" \
  -H "Type: Raw Events" \
  -H "Compression: NONE" \
  --data-binary @sample.csv

-k accepts the stack's self-signed certificate. -v shows you the response headers, which is the point of this step as much as the data is. Replace <your API key> with the key you copied. /stroom/datafeeddirect is the stack's route straight into Stroom. Its /stroom/datafeed goes to Stroom Proxy first, which batches data for up to ten minutes before passing it on.

How long: immediate

Receipt is synchronous. By the time curl returns 200, the data is stored and a stream exists. You can look for it straight away.

Check it worked

Look at two things, in this order.

The response. A 200, with a receipt id as the response body, such as 1791979698715_0000_S_node1a. That is Stroom saying it has the data.

The stream. Open the feed and go to its Data tab. A stream should be listed, of type Raw Events, created just now.

The check that matters most

A stream on the feed's Data tab.

Nothing else proves receipt. A 200 on its own does not, as the trap below explains.

This does not prove it worked

A 200 is not proof the data was kept. A feed set to Drop returns 200 and discards what you sent.

An empty Data tab may be the filter, not the data. The tab only lists unlocked streams, so a stream still being written, or one that has been deleted, is not shown.

Fails silently

If you gzip the file, you must say so in a header.

Stroom chooses its decompressor from Compression. Send gzipped bytes without it and the post succeeds, the data is stored as-is, and nothing complains, even when a pipeline reads it. (Content-Encoding: gzip also works, because the web server decodes it before Stroom sees the data, but use one header or the other, never both.)

It is worth doing once deliberately, so you recognise it later. See The datafeed contract.

If it isn't working

In order. Each step rules out a class of cause, so don't skip ahead.

  1. What did curl -v print? The HTTP status, plus Stroom-Status and Stroom-Error (see Datafeed response codes) when something is wrong. Those two usually name the problem outright.
  2. Is it a 401? Stroom-Status 302, Client token or certificate required, means the post carried no credentials. Check the Authorization header is present and the API key is the one you copied, and that the key is enabled and has not expired.
  3. Does the feed name match exactly? 406 with a status of 100, Feed must be specified, means there was no Feed header. 406 with a status of 110 means no feed of that name is set to receive, which is also what a misspelt or lower-case name gives you. Feed names are exact, including case.
  4. Is the feed set to receive? Check Feed Status on the Settings tab. A feed set to Reject gives the same 406 and 110 as a feed that does not exist.
  5. Did it go through the proxy? A receipt id with _P_ in it, rather than _S_, came from Stroom Proxy, which can take up to ten minutes to pass data on. Post to /stroom/datafeeddirect as above.

Next

You have raw data. It is still exactly the CSV you sent, which is not yet something you can search. Next, turn it into events.

All documentation