Private ingest in Mumbai (Enterprise)

If your services run in Oracle Cloud (OCI) in the Mumbai region (ap-mumbai-1), Logthread can receive your telemetry over a private network path instead of the public internet. Nothing changes in your collectors or SDKs: they keep sending to https://ingest.logthread.com with the same ingest key and the same certificate. Only the route the traffic takes is different.

Private ingest is included with the Enterprise plan at no extra charge. Logthread support sets it up with you; it is not self-service.

Why use it#

• No internet egress. Your telemetry stays inside the region, so it does not count toward your internet data transfer and never crosses the public internet.
• Lower latency and fewer moving parts. Data goes straight from your network to Logthread's private ingest endpoint, without leaving the region.
• Same everything else. Same endpoints, same keys, same TLS certificate, same limits and the same data in Logthread.

How it works#

1. Your virtual cloud network (VCN) and Logthread's are connected with a local peering gateway, a private link between two networks in the same region. Address ranges must not overlap; Logthread uses 10.40.0.0/16.
2. A private DNS view on your VCN resolves ingest.logthread.com to Logthread's private ingest address. Everything else resolves as before.
3. Logthread's private ingest endpoint accepts traffic only from the address ranges you give us, on the same ports as public ingest:

TLS is verified as usual: the certificate is the public one for ingest.logthread.com.

Set it up#

1. Contact Logthread support from the workspace owner's email with:
2. your OCI tenancy, region (must be ap-mumbai-1) and VCN address ranges;
3. which subnets send telemetry.
4. Support creates Logthread's side and sends you the peering details and the private address.
5. You create your local peering gateway, a route for 10.40.0.0/16 through it, a firewall rule (security list or network security group) allowing outbound traffic to that address on the ports you use, and the private DNS zone ingest.logthread.com pointing at the address.
6. Verify from a host in your network:

dig +short ingest.logthread.com          # the private address, not a public one
curl -sS https://ingest.logthread.com/healthz

Then send data as usual and check it in Explore. If DNS still returns a public address, the private view is not attached to the VCN's resolver.

Good to know#

• Private ingest covers sending data. The Logthread app and API stay at https://logthread.com.
• If the private path is unavailable, your collectors cannot fall back to the public internet on their own, because the name resolves privately. Keep your collectors' retry queues on (the OpenTelemetry Collector's sending_queue, the SDKs' buffers) so short interruptions lose nothing.
• Removing private ingest is the reverse: delete the DNS zone first, so traffic returns to the public endpoint, then the peering.

Next: find your data in Explore and live tail.