> ## Documentation Index
> Fetch the complete documentation index at: https://stellar-relay.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Output format

> Understand the TCP/NDJSON delivery format and receiver expectations.

The relay sends **newline-delimited JSON (NDJSON) over TCP**.

## Transport and framing

Each record is one JSON object followed by a newline:

```text theme={null}
{"...":"..."}\n
{"...":"..."}\n
{"...":"..."}\n
```

A receiver should treat each newline as a record boundary rather than waiting for a JSON array or a larger document.

## Alert and case records

Alert and case events are transmitted as JSON records. The receiving workflow can distinguish alert and case records using fields in the emitted JSON.

Before creating a production SIEM parser, capture representative alert and case events from your deployed version and validate the fields used for routing and mapping.

## Separate delivery paths

Alert and case streams have independent destination settings:

```text theme={null}
Alert destination: --alert-syslog-ip + --alert-syslog-port
Case destination:  --case-syslog-ip  + --case-syslog-port
```

This allows separate ingestion paths:

```text theme={null}
Stellar Cyber API
       |
       v
Relay daemon
   |        |
   |        +--> Case listener
   +-----------> Alert listener
```

Both streams can also point to the same downstream system.

## About the `syslog` option names

The runtime CLI retains option names such as `--alert-syslog-ip` and `--case-syslog-port`. The documented payload itself is **NDJSON over TCP, one JSON object per line**.

<Info>
  Configure the receiver for line-delimited JSON over TCP. Do not assume RFC 3164 or RFC 5424 framing solely because the CLI option names contain `syslog`.
</Info>

## Receiver checklist

Verify the following before production use:

* The receiver is listening on the configured TCP port.
* Network policy allows the relay host to connect.
* A newline is treated as the record boundary.
* Each line parses as one JSON object.
* Alert and case routing is tested with real sample records.
* SIEM-side timestamp, source-type, and field mappings are validated against actual output.

## Case summary output

The case example uses:

```bash theme={null}
--case-include-summary \
--no-case-format-summary
```

These options are useful when the destination workflow needs the case summary while preserving it without additional formatting.