Prometheus Remote Write

The Prometheus Remote Write source runs an HTTP server that receives metrics pushed to it by Prometheus servers, or any Prometheus remote-write-compatible agent, using the remote write protocol. The collector listens on a configurable address and port and accepts remote write requests at /api/v1/write. Unlike the Prometheus scrape source, this source does not poll targets; senders push metrics to the collector.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux	✓
Windows	✓
macOS	✓

Prerequisites

• One or more Prometheus servers (or remote-write-compatible agents) configured to remote_write to the collector. Point each sender's remote_write url at the collector endpoint, for example http://<collector-host>:9090/api/v1/write. See the Prometheus remote_write configuration reference.

• Network reachability from the senders to the collector on the configured listen port. Open any host or network firewall rules so the senders can reach that port.

• When binding to a port below 1024, the collector must run as root (Linux) or Administrator (Windows).

Configuration

Listen

Parameter	Type	Required	Default	Description
Listen Address	string	No	0.0.0.0	The IP address to listen on.
Listen Port	int	Yes	9090	TCP port to receive Prometheus Remote Write requests. The collector must be running as root (Linux) or Administrator (Windows) when binding to a port below 1024. Valid range is 1 to 65535.

Advanced

Parameter	Type	Required	Default	Description
Enable TLS	bool	No	false	Whether or not to use TLS.
TLS Certificate File	string	Yes	(empty)	Path to the TLS certificate file for the server. Shown when Enable TLS is true.
TLS Private Key File	string	Yes	(empty)	Path to the TLS private key file for the server. Shown when Enable TLS is true.
Mutual TLS	bool	No	false	Whether or not to require client TLS authentication (mTLS). Shown when Enable TLS is true.
TLS Certificate Authority File	string	Yes	(empty)	Path to the certificate authority file for authenticating client certificates. Shown when Enable TLS and Mutual TLS are true.
Include Metadata	bool	No	false	Propagates the incoming connection's metadata to downstream consumers.
Configure CORS	bool	No	false	Enable Cross-Origin Resource Sharing support for HTTP requests.
CORS Allowed Origins	strings	No	(empty)	A list of origins a cross-domain request can be executed from. Shown when Configure CORS is true.
CORS Allowed Headers	strings	No	(empty)	The allowed headers sets what headers will be allowed in CORS requests. Shown when Configure CORS is true.
CORS Max Age	int	No	0	Indicates how long (in seconds) the results of a preflight request can be cached. Shown when Configure CORS is true.

Examples

Receive remote write on the default port

This source listens on all interfaces on port 9090 and accepts remote write requests at /api/v1/write.

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: prometheus-remote-write
spec:
  type: prometheus_remote_write
  parameters:
    - name: listen_address
      value: "0.0.0.0"
    - name: listen_port
      value: 9090

A Prometheus server sends to this collector with a remote_write block in prometheus.yml:

remote_write:
  - url: "http://collector.example.com:9090/api/v1/write"

Configuration Tips

• The receive endpoint path is /api/v1/write. Senders must target that path, not the host and port alone.

• Set Listen Address to 0.0.0.0 to accept requests on all interfaces, or to a specific interface IP to restrict where the server binds.

• Enable TLS (and optionally Mutual TLS) when senders push over an untrusted network so metrics are encrypted in transit.

Troubleshooting

Senders receive a 404 response

Symptoms: Prometheus reports remote write failures and the collector logs no received metrics.

Solutions:

1. Confirm the sender's remote_write url ends in /api/v1/write.

2. Confirm the host and port in the sender's URL match the source's Listen Address and Listen Port.

Senders cannot connect to the collector

Symptoms: connection refused or timeout errors on the sending side.

Solutions:

1. Verify a host or network firewall allows inbound traffic to the listen port.

2. If binding to a port below 1024, confirm the collector runs as root (Linux) or Administrator (Windows).

TLS handshake failures

Symptoms: senders log TLS or certificate errors when Enable TLS is on.

Solutions:

1. Confirm the certificate and key file paths are correct and readable by the collector.

2. When Mutual TLS is enabled, confirm the CA file authenticates the client certificates the senders present.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: prometheus-remote-write
spec:
  type: prometheus_remote_write
  parameters:
    - name: listen_address
      value: "0.0.0.0"
    - name: listen_port
      value: 9090
    - name: enable_tls
      value: true
    - name: cert_file
      value: /opt/tls/server.crt
    - name: key_file
      value: /opt/tls/server.key
    - name: include_metadata
      value: false

Related Resources

• Prometheus Remote Write receiver (prometheusremotewritereceiver)

• Prometheus remote_write configuration