- ElasticsearchSource: POST _search API with query_string, parse hits._source - KibanaSource: GET saved_objects/_find API with kbn-xsrf header - SplunkSource: GET search/jobs/export API with newline-delimited JSON parsing - All sources use ciLogKeyPattern for key detection - Tests use httptest mocks for each API endpoint