Adding data by file upload
The fastest way to explore a dataset without an agent: upload a local file and let the platform parse it. This is the File Upload surface in the data collection area, the third of the three data-ingest paths alongside agent collection and server-side listening collection.
Where it is
Section titled “Where it is”Data Collection → File Upload. File Upload is an item in the Data Collection navigation, and also a card in the Data Sources catalog.
It is also the first card of the tutorial under the ? menu in the top bar, which is the shortest route from a fresh install.
The flow
Section titled “The flow”The wizard is three numbered steps, in this order:
- Select File — drag or drop a data file (or browse). One file at a time. There is no file-type filter — the picker accepts any file, and what makes it parseable is the source type you choose in step 2, not the extension. So a file the source type cannot parse still uploads, and yields nothing useful; pick the source type with the file in mind.
- Select Sourcetype — pick an existing source type or create one for the data. The source type defines how the stream is split into events, how the timestamp is extracted, and how fields are parsed — the same source-type model as agent collection (see indexes-and-field-extraction.md). You choose it against a preview of the file, so the parsing is settled before any data is stored.
- Upload Data — the file is sent and ingested with the source type you picked.
Limits
Section titled “Limits”| Limit | Value | Where it is enforced |
|---|---|---|
| Maximum file size | 100 MiB (100 * 1024 * 1024 bytes) | In the browser, before upload. The dragger prints “The maximum file upload size is 100MB”, and an oversize file is refused with “File size exceeds 100MB”. |
| Files per upload | 1 | The picker keeps only the first file selected. |
| Accepted types | any | No extension filter is applied. |
| Preview sample | first 2 MB, and of that the first 1,000 lines | The source-type step reads only the head of the file to render its preview, so a rule that looks right on the sample can still meet different data further down. |
Two consequences worth knowing before you upload:
- The size limit is client-side. It is a guard in the uploader, not a server-side quota, so it protects the browser rather than the cluster.
- An empty file is not refused. It uploads and parses to nothing — there is no error, and the result is an empty preview rather than a message telling you why. If a source type shows no sample data, check the file has content before you start editing parsing rules.
Read out of the shipping uploader on 7 Sep 2026 — the step order and every
figure above come from constant.ts, getStepContent and the uploader’s own
store, not from the screen. The click path was re-walked in the product on
17 Sep 2026, when a second, near-identical copy of this wizard at /data/upload
was retired: it was a fork that had drifted from this one, and only this one is
reachable from the navigation.
After parsing, the data is searchable from the search page. Because file upload is a one-shot ingest, the fields it produces are whatever the source type’s parsing rules declare — the same “parse at ingest” model the agent applies in its transformers.