Onboard logs in minutes with @nano-rs/connect — generate edge Vector collectors, deploy parsers, and verify data is flowing

connect CLI

@nano-rs/connect is a zero-install CLI that points real data at your nano instance. It connects to your deployment, stands up edge Vector collectors in your environment (syslog, Windows Event Log + Sysmon, Linux journald + files), wires them to nano, deploys matching parsers, and verifies events arrive and become searchable — no MCP, no Kubernetes, no hand-written config.

npx @nano-rs/connect

How it works

connect generates Vector configuration for the edge of your network and forwards to nano over the Vector-native protocol (protobuf, acknowledgements, backpressure, disk buffering). The topology scales from a single box to a fleet:

Agents run on endpoints and ship to an aggregator (or straight to nano for small setups).
The aggregator is the hub — receives agents and syslog devices, forwards to nano.

Two secrets, by design. An API key talks to the nano API (verify + parser deploy); a separate ingest token (VECTOR_AUTH_TOKEN) authenticates the logs themselves. connect mints a scoped API key for you (showing the permissions first), and reuses your self-hosted .env for the ingest token.

Prerequisites

A running nano deployment and its URL
Docker (only if you want connect to run the collector for you with --run)

Step 1: Connect

npx @nano-rs/connect connect --url https://your-nano-instance.com

This authenticates (reuses your install's .env, or logs you in and mints a scoped key), then sends a test event to confirm the ingest path — auto-detecting your endpoint shape (/ingest, a dedicated ingest-<sub> host, or the open-core :8080).

Step 2: Set up a collector

Pick the generator that matches what you're collecting.

Syslog devices

npx @nano-rs/connect add-source --devices cisco_asa,palo_alto --run --deploy-parsers

One listener port per device type (so each vendor routes to the right parser). Point your firewalls/switches at <this-host>:5514 (Cisco ASA), :5515 (Palo Alto), etc. — the generated README.md lists every port.

Windows endpoint

npx @nano-rs/connect add-agent --os windows --target aggregator.internal:9000

Native Windows Event Log + Sysmon collection. Copy the folder to the endpoint and run install-agent.ps1 (elevated) — it verifies the Vector MSI signature and registers the service.

Linux endpoint

npx @nano-rs/connect add-agent --os linux --target aggregator.internal:9000

journald + Sysmon for Linux (auto-tagged) + any log files you specify. Install via the generated systemd unit.

Aggregator

npx @nano-rs/connect add-aggregator --run

The hub that fans endpoint agents (:9000) and syslog devices into nano. Point your agents at <this-host>:9000.

--run pulls the Vector image and starts the collector right there, then waits for it to report healthy. --deploy-parsers auto-deploys the matching community parser.

Step 3: Verify

npx @nano-rs/connect verify --source cisco_asa

◇  142 cisco_asa event(s) searchable in the last 15m — normalized ✓

Parsers

When you onboard a source, connect tells you whether nano already parses it, whether a community parser is available (and offers to deploy it), or whether there's none yet.

A missing parser never blocks onboarding. Data still flows and is searchable as generic logs — a parser just normalizes it into UDM fields for better detection and dashboards. Build one in the Parser Editor, with the nano-investigator MCP, or contribute to nano-rs/parsers.

Command reference

Command	Purpose
`connect`	Connect + authenticate, send a test event
`add-source`	Syslog collector (one port per device type)
`add-agent --os windows\|linux`	Endpoint agent (Event Log/Sysmon, or journald/files)
`add-aggregator`	Aggregator pool
`verify --source <type>`	Check a source_type is arriving + normalized

Common flags: --run (start it here), --deploy-parsers (auto-deploy parsers), --url / --api-key / --env-file (auth), --non-interactive (CI).

Next steps

On-premise collection — the manual Vector aggregator setup connect automates
Routing model — how source_type drives parser selection

connect CLI

On this page