# Streaming Render Service Logs

You can stream the logs generated by your Render services to any logging provider with a TLS-enabled [syslog](https://en.wikipedia.org/wiki/Syslog) endpoint, such as Datadog or Sumo Logic. This includes [HTTP request logs](logging#http-request-logs) for *Professional* workspaces and higher.

After you set a default stream destination for your workspace, all of your supported services start streaming their logs to that destination. You can [override this](#overriding-defaults) for individual services.

Render does not emit logs for [static sites](static-sites). Log stream support is not yet available for [workflows (early access)](workflows).

## Setup

1. From your workspace home in the [Render Dashboard][dboard], click *Integrations > Observability* in the left pane.
2. Scroll down to the *Log Streams* section:

   [img]

3. Under *Default destination*, click *+ Set default*.

   The following dialog appears:

   [img]

4. Provide your syslog endpoint URL in the *Log Endpoint* field.
   - Use the format `HOST:PORT` (for example, `logs.papertrailapp.com:34302`).
   - For help finding the endpoint URL with common providers, [see below](#finding-your-syslog-endpoint).
5. If Render needs to include an authentication token with all reported logs, provide it in the *Token* field.
   - This is required for logging providers that use a single syslog endpoint for multiple users, such as Datadog.
6. Click *Save Changes*.
7. Toggle *Include logs from preview instances* to configure whether your log stream includes logs from your [service previews](service-previews) and [preview environments](preview-environments).

You're all set! Logs from Render will start to appear in your provider's feed shortly.

## Overriding defaults

[*Professional* workspaces](professional-features) and higher can override log stream settings for individual services:

| Custom Setting | Hobby | Professional | Organization / Enterprise |
|--------|--------|--------|--------|
| Omit individual services from log stream | ❌ | 🟢 | 🟢 |
| Set a custom destination for individual services | ❌ | ❌ | 🟢 |

1. In the [Render Dashboard][dboard], open the Settings page for the service you want to override and scroll down to the *Log Stream* section:

   [img]

2. Open the *•••* menu and click *Override*. The following dialog appears:

   [img]

3. Select *Forward to a different destination* or *Don't forward this service's logs*.

   - Forwarding to a different destination requires an Organization workspace or higher.

4. Provide any necessary details for the selected option and click *Save override*.

You're all set! Your service now uses its own custom log stream settings:

[img]

You can revert this custom configuration by clicking *Reset to default*.

## Reporting format

Render streams logs to your provider's syslog endpoint over TCP. Log lines are formatted according to [RFC5424](https://tools.ietf.org/html/rfc5424), which is supported by most popular providers.

Log streams do _not_ support:

- Insecure (non-TLS-enabled) endpoints
- Providers that require a custom log format

> If you encounter issues integrating with a syslog-compatible provider, please let us know at *support@render.com*.

A formatted log line looks like this:

```
<0>1 2021-03-31T16:00:00-08:00 test-service cron-12345 74440 cron-12345 - hello this is a test
```

Render annotates each log line with:

- The corresponding service's slug
- The type of service (`web`, `cron`, etc.)
- A unique identifier for the instance
  - Use this value to track your service between deploys, or to distinguish between multiple instances if you're running more than one.

If you're using a standard format like `logfmt` or `json`, Render maps the `level` field to an appropriate syslog priority. Otherwise, Render makes a best effort to parse log levels, defaulting to `INFO`.

## Finding your syslog endpoint

Consult your logging provider's documentation to obtain your syslog endpoint and any necessary token. Instructions for certain providers are also available below.

> If there’s a logging provider you’d us to add to this list, please submit a [feature request](https://feedback.render.com).

### Better Stack

1. From the **Telemetry** section of your Better Stack dashboard, click **Sources** in the left sidebar.

2. Click **Connect source**. The following form appears:

    [img]

3. Give your source a descriptive **Name** (e.g., "Render log stream").

4. Under **Platform**, switch to the **Logs** tab and select **Render**.

5. Click **Connect source**. Better Stack opens the details page for your new source:

    [img]

6. Copy your source's **Ingesting host** URL.

    Provide this value as your log stream's **Log Endpoint** in the Render Dashboard, and append the port `6514` to the end. For example:

    ```
    s1636872.eu-nbg-2-vec.betterstackdata.com:6514
    ```

7. Copy your source's **Source token**.

    Provide this value as your log stream's **Token** in the Render Dashboard.

8. In the Render Dashboard, click **Add Log Stream**.

After you save your changes, Render logs start to appear in the **Logs & traces** tab of your Better Stack dashboard within a few minutes:

[img]

For more information, see the [Better Stack documentation](https://betterstack.com/docs/logs/render).

### Datadog

See [this section](datadog#streaming-service-logs-and-metrics).

### highlight.io

To stream logs to your existing highlight.io project:

- Provide `syslog.highlight.io:34302` as the **Log Endpoint**.
- Provide your highlight project ID as the **Token**.
  - Your highlight project ID is shown in the top left of your project page.

For more information, see the [highlight.io documentation](https://www.highlight.io/docs/getting-started/backend-logging/hosting/render).

### Mezmo (previously LogDNA)

> We've observed high rates of connection failures with Mezmo's syslog endpoint and do not recommend using them with Render at this time.

Log in to your Mezmo account and navigate to the [sources page](https://app.logdna.com/pages/add-source). Select **syslog** on the left sidebar to see your syslog endpoint.

[img]

### Papertrail

Log in to your account and navigate to the [setup page](https://papertrailapp.com/systems/setup?type=system&platform=unix#unix-manual) to find your Syslog endpoint:

[img]

If you use the same Papertrail account to collect logs from multiple providers, you can optionally [generate a unique endpoint for your Render services](https://papertrailapp.com/destinations/new).

### SolarWinds

Follow the instructions for [sending logs using syslog](https://documentation.solarwinds.com/en/success_center/observability/content/configure/configure-logs-syslog.htm).

- Set the **Log Endpoint** to your organization's syslog collector endpoint. This endpoint has the format `syslog.collector.xx-yy.cloud.solarwinds.com:6514`, where `xx-yy` represents the data center your organization uses. See [Data centers and endpoint URIs](https://documentation.solarwinds.com/en/success_center/observability/content/system_requirements/endpoints.htm) to find the exact URL.
- Provide your API ingestion token as the *Token*.
  - Your API ingestion token is found in the Token field.

### Sumo Logic

Follow the instructions for [configuring a cloud syslog source](https://help.sumologic.com/docs/send-data/hosted-collectors/cloud-syslog-source/#configure-a-cloudsyslogsource).

After you configure your source, Sumo Logic displays a modal with a *Token* and *Host*. Use these for your log stream's *Token* and *Log Endpoint*, respectively.