Compare ingestion methods

You can ingest events and metrics using the APEX AIOps Incident Management UI or through non-UI based methods either with command line operations using JSON data or with Incident Management APIs. Read Ingestion methods for an overview of ingestion methods. The following tables outline some key differences between various ingestion methods.

You can ingest events and metrics through a number of different mechanisms, some pull and others push based.

Pull-based ingestion types include integrations like Amazon Cloudwatch and Azure and some collector plugins.
Push-based integrations include integrations like CYOI, Events API, Metrics API, and some Collector plugins. The push based integrations provide an API that can be called to push the data.

The following ingestion tables list our supported integrations and information about each integration. The tables include:

The type of ingestion method.
Support for either events or metrics or both.
Whether the ingestion method is UI-based or requires command line or API actions.
Whether the ingested data is mapped by default, requires mapping, or allows customizable mappings.
Whether you can customize the event deduplication key when you configure the ingestion. (You can modify deduplication keys after ingestion using the Workflow Engine.)

Note

Some of these ingestion methods will require a valid API key to work. To create a new API key to use with your ingestion method, read Create an API key.

App ingestion

The App-based ingestions are listed by product name and provide a comparative summary about each integration.

Table 1. Compare ingestion methods by product

Product name	Ingestion method	Events & Metrics	UI-based	Mapping	Deduplication key
Amazon Cloudwatch	Cloud-to-Cloud	Both	Yes	Yes	No
Ansible Tower	UI-based documentation instructions Push-based	Events	Instructions in the UI	Optional	Optional
AppDynamics (pre-configured)	Pre-configured Push-based	Events	Yes, with some UI-based instructions	Optional	Optional
Azure	UI-based documentation instructions Push-based	Events	Instructions in the UI	Optional	Optional
Azure App Insights	Cloud-to-Cloud	Both	Yes	Mapping specified	No
Cribl Logstream	Documentation instructions only Uses CYOI Push-based	Both	Only CYOI portion	Yes	No
Dynatrace	CYOI Push-based	Events	Yes	Mapping varies	Key provided
Google Cloud Operations (formerly Stackdriver)	UI-based documentation instructions Uses CYOI Push-based	Events	Instructions in the UI	Mapping varies	Yes
Microsoft SCOM (Service Center Operations Manager)	UI-based documentation instructions Push-based	Events	Instructions in the UI	Mapping varies	No
Nagios	UI-based documentation instructions Push-based Webhook-based	Events	Instructions in the UI	Mapping varies	No
New Relic (pre-configured)	Pre-configured Uses webhook	Events		Automatic or default mapping	Key provided
Pingdom	Pre-configured Push	Events	Yes	Mapping varies	UI - Provides recommended key Advanced - Allows custom keys
Prometheus Alertmanager	Pre-configured Push-based	Events	Yes	Optional	Optional
Prometheus Remote Write	UI-based documentation instructions Push-based	Metrics	Instructions in the UI	No	No
Splunk	UI-based documentation instructions Push-based	Events	Instructions in the UI	Mapping specified	Yes
Sumo Logic	UI-based documentation instructions Push-based	Events	Instructions in the UI	Mapping varies	Yes
Telegraf	UI-based documentation instructions Push-based	Metrics	Instructions in the UI	Mapping varies	No
Zabbix	CYOI Push-based	Events	Yes	Mapping varies	UI - Provides recommended key Advanced - Allows custom key

In addition to app-based ingestion, Incident Management features collectors and plugins that simplify the task of ingesting data from different sources.

Collector ingestion

Incident Management features collectors that you can install on Linux, Mac, and Windows systems. You can use these collector agents to gather system information and when used in combination with an enabled plugin, they also can gather events, metrics, or both from supported apps. For all collectors, the System plugin is enabled by default.

Product name	Ingestion method	Events & Metrics	UI-based	Mapping	Deduplication key
Advanced Configuration (local configuration)	Collector agent	Both	Both UI and command line installation. Let's you create and use a JSON-based local configuration file.	Default mapping provided	Default provided
Linux-based OS (CentOS, Redhat, Ubuntu)	Collector agent	Both	Partially. Requires a cut and paste of a few lines from the UI to a terminal	Default mapping provided	Default provided
Macintosh OS (M1 architecutre not currently supported)	Collector agent	Both	Partially. Requires a cut and paste of a few lines from the UI to a terminal	Default mapping provided	Default provided
Windows OS	Collector agent	Both	UI and installation wizard. Installation can also be done at the command line.	Default mapping provided	Default provided

Collector plugin ingestion

Incident Management supports a number of plugins that work in combination with a collector agent to deliver data to Incident Management.

Product name	Ingestion method	Events & Metrics	UI-based	Mapping	Deduplication key
AppDynamics	Collector Collector Plugin	Both	Yes	Default mapping provided	Default deduplication key provided
Docker	Collector Plugin	Metrics	Yes	Default mapping provided	Default deduplication key provided
HTTP Listener	Collector Plugin Uses Create Your Own Integration (CYOI) Push-based	Both	Yes	Default mapping provided	Default deduplication key provided
MongoDB	Collector Plugin	Metrics	Yes	Default mapping provided	Default deduplication key provided
New Relic	Collector Plugin Uses webhook Push-based	Events	Yes	Default mapping provided	Default deduplication key provided
Prometheus Scrape	Collector Plugin Push-based	Metrics	Yes	Default mapping provided	Default deduplication key provided
Redis	Collector Plugin Push-based	Events	Yes	Default mapping provided	Default deduplication key provided
System	Collector Plugin Push-based Enabled by default with all collector installations	Metrics	Yes	Default mapping provided	Default deduplication key provided

API-based ingestion

Incident Management provides a set of APIs that enable you to perform data ingestion programmatically.

Table 2. API-based ingestion methods

API name	Events & Metrics	Mapping	Methods	Deduplication key
CYOI API	Either	User specified mapping	GET, PUT, POST	Can be set in the UI
Events API	Events	Expects data inIncident Management format	POST via script (REST integration via Webhook)	Can be set via terminal Can be set as a field in the JSON payload
Metrics API	Metrics	Expects data in format	(POST via script REST integration via Webhook)	Can be set via terminal

API name

Events & Metrics

Mapping

Methods

Deduplication key

CYOI API

Either

User specified mapping

GET, PUT, POST

Can be set in the UI

Events API

Events

Expects data inIncident Management format

POST via script

(REST integration via Webhook)

Can be set via terminal

Can be set as a field in the JSON payload

Metrics API

Metrics

Expects data in format

(POST via script

REST integration via Webhook)