Parseable

Open Marketplace in the Azure Portal, search for Parseable, select the SecureAnyCloud publisher entry, and choose Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range. Also allow TCP 443, and TCP 80 for the HTTP-to-HTTPS redirect, from the networks that will send telemetry and use the UI. The per-VM admin credential protects every endpoint, but you should still restrict source ranges.

Choose Review + create, wait for validation, and then choose Create. Deployment takes around two minutes.

RG="parseable-prod" LOCATION="eastus" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:parseable-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name parseable-01 \
  --image sac1647283583153:parseable-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Allow SSH (22), HTTPS (443) and the HTTP->HTTPS redirect (80) from your trusted ranges az vm open-port --resource-group "$RG" --name parseable-01 --port 22 --priority 1001 az vm open-port --resource-group "$RG" --name parseable-01 --port 443 --priority 1002 az vm open-port --resource-group "$RG" --name parseable-01 --port 80 --priority 1003

If you prefer to use the URN shown on the Marketplace listing, copy it from the Usage Information tab and use it in place of <publisher>:<offer>:<sku>.

Connect to the VM as azureuser. Use the private key that matches the public key you supplied at deploy time.

ssh azureuser@<vm-public-ip>

Confirm that the Parseable server and the nginx proxy are running, and check the listening sockets. Parseable binds to 127.0.0.1:8000 only, so it is reachable from outside the VM solely through nginx on port 443. The AGPL-3.0 license ships with the image.

parseable --version systemctl is-active parseable nginx
sudo ss -ltn | grep -E ':443 |:8000 ' head -2 /usr/local/share/parseable/LICENSE

Expected output:

parseable 3.0.0 active active LISTEN 0 2048 127.0.0.1:8000 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:* LISTEN 0 511 [::]:443 [::]:* GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007

On the first boot of your virtual machine, parseable-firstboot.service generates an admin password unique to your instance and a per-instance TLS certificate. It writes the credentials to a root-only file. Read the file with:

sudo cat /root/parseable-credentials.txt

The file reports the HTTPS URL and the admin login:

parseable.url=https://<vm-public-ip>/ parseable.admin.user=admin parseable.admin.pass=<generated-per-vm>

Run the shipped self-test to confirm the whole credential model without printing any secret. It proves the HTTP-to-HTTPS redirect, that the upstream admin/admin default (and common guesses) are rejected, and that the per-VM credential is accepted:

sudo bash /usr/local/sbin/parseable-credcheck.sh

Expected output:

OK

The per-VM admin credential guards every Parseable endpoint, and only the health probes answer without authentication. The upstream admin/admin default is rejected. You can see this with curl. The -k flag accepts the per-VM self-signed certificate:

AP=$(sudo grep '^parseable.admin.pass=' /root/parseable-credentials.txt | cut -d= -f2-)
curl -ks -o /dev/null -w 'liveness (no auth) -> HTTP %{http_code}\n' https://127.0.0.1/api/v1/liveness
curl -ks -o /dev/null -w 'API no auth -> HTTP %{http_code}\n' https://127.0.0.1/api/v1/logstream
curl -ks -o /dev/null -w 'API default admin:admin -> HTTP %{http_code}\n' -u 'admin:admin' https://127.0.0.1/api/v1/logstream
curl -ks -o /dev/null -w 'API per-VM admin -> HTTP %{http_code}\n' -u "admin:$AP" https://127.0.0.1/api/v1/logstream

Expected output:

liveness (no auth) -> HTTP 200 API no auth -> HTTP 401 API default admin:admin -> HTTP 403 API per-VM admin -> HTTP 200

In a browser, go to https://<vm-public-ip>/. The certificate is self-signed and generated per VM, so your browser warns you on the first visit. Accept the warning, or install a CA-signed certificate as described in Step 11. Sign in with user admin and the parseable.admin.pass value from Step 5.

After you sign in, you land on the Parseable console. From there you can create log streams, explore ingested events and run SQL queries.

Parseable organizes telemetry into log streams. Create a stream, then send events to it with an authenticated POST to /api/v1/ingest. Use the X-P-Stream header to name the stream and a JSON array as the body. You can run the commands from any client that can reach the VM. This example uses the VM itself over loopback:

AP=$(sudo grep '^parseable.admin.pass=' /root/parseable-credentials.txt | cut -d= -f2-)
# Create the stream curl -ks -o /dev/null -w 'create stream -> HTTP %{http_code}\n' \
  -X PUT -u "admin:$AP" https://127.0.0.1/api/v1/logstream/demoapp
# Ingest a batch of events curl -ks -o /dev/null -w 'ingest -> HTTP %{http_code}\n' \
  -X POST -u "admin:$AP" -H 'X-P-Stream: demoapp' -H 'Content-Type: application/json' \
  --data '[ {"host":"web-01","level":"info","service":"checkout","status":200,"message":"order placed"}, {"host":"web-02","level":"warn","service":"checkout","status":200,"message":"slow response"}, {"host":"api-01","level":"error","service":"payments","status":504,"message":"gateway timeout"} ]' https://127.0.0.1/api/v1/ingest

Expected output:

create stream -> HTTP 200 ingest -> HTTP 200

Parseable detects the schema from the JSON automatically and stamps every event with a p_timestamp. Point your applications, agents and log shippers (Fluent Bit, Vector, the OpenTelemetry collector and more) at the same /api/v1/ingest endpoint.

Query a stream with an authenticated POST to /api/v1/query. Pass the SQL statement and a time window. The response is a JSON array of rows:

AP=$(sudo grep '^parseable.admin.pass=' /root/parseable-credentials.txt | cut -d= -f2-)
T0=$(date -u -d '-1 hour' +%Y-%m-%dT%H:%M:%SZ)
T1=$(date -u -d '+1 hour' +%Y-%m-%dT%H:%M:%SZ)
curl -ks -u "admin:$AP" -H 'Content-Type: application/json' \
  --data "{\"query\":\"SELECT host, level, service, status, message FROM demoapp ORDER BY status DESC\",\"startTime\":\"$T0\",\"endTime\":\"$T1\"}" \
  https://127.0.0.1/api/v1/query | jq -c '.[]'

Expected output:

{"host":"api-01","level":"error","service":"payments","status":504.0,"message":"gateway timeout"} {"host":"web-02","level":"warn","service":"checkout","status":200.0,"message":"slow response"} {"host":"web-01","level":"info","service":"checkout","status":200.0,"message":"order placed"}

The same SQL also runs interactively in the web UI, where you can build filters, save queries and chart results.

The P_PASSWORD environment variable sets the admin credential, and it is kept in a root-only env file. To rotate the password, edit the value and restart the service:

sudoedit /etc/parseable/parseable.cred.env
# change the P_PASSWORD= <set-at-first-boot>
sudo systemctl restart parseable

The image ships a per-VM self-signed certificate. For production, replace it with a CA-signed certificate on the bundled nginx. Point your DNS A record at the VM's public IP and open port 443 in the network security group. Then run:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot updates the bundled nginx virtual host in place and preserves the reverse-proxy access model.

By default, Parseable stores telemetry on the VM's local disk (local-store). To store data in an S3-compatible object store instead, which is the basis of a distributed Parseable deployment, switch the service to s3-store and provide your bucket details. Edit the systemd unit's ExecStart to parseable s3-store and add the S3 settings to /etc/parseable/parseable.env:

# /etc/parseable/parseable.env (S3-compatible object store) P_S3_URL=https://s3.<region>.amazonaws.com P_S3_ACCESS_KEY=<access-key> P_S3_SECRET_KEY=<secret-key> P_S3_REGION=<region> P_S3_BUCKET=<bucket>

See the Parseable storage documentation for the full list of object-store settings. AWS S3, MinIO, Azure Blob and GCS are all supported.

Use the following commands to check status and logs, restart Parseable after a configuration change, and reload nginx:

# Status and logs systemctl status parseable --no-pager sudo journalctl -u parseable -n 100 --no-pager
# Restart after changing configuration
sudo systemctl restart parseable
# nginx (the TLS reverse proxy)
sudo nginx -t && sudo systemctl reload nginx