mirror of
https://github.com/fosrl/docs-v2.git
synced 2026-07-17 11:30:00 +00:00
5d6448aafa
Add context-aware alt text to 36 images across 20 MDX files flagged by mint a11y. Descriptions are derived from each image's caption and surrounding step text. Part of fosrl/docs-v2#116.
51 lines
2.5 KiB
Plaintext
51 lines
2.5 KiB
Plaintext
---
|
|
title: "Event Streaming"
|
|
description: "Stream Pangolin log events to external collectors and SIEM tools"
|
|
---
|
|
|
|
import PangolinCloudTocCta from "/snippets/pangolin-cloud-toc-cta.mdx";
|
|
|
|
<PangolinCloudTocCta />
|
|
|
|
Log streaming forwards your organization's audit logs to external data collectors such as Datadog, Splunk, Microsoft Sentinel, Elastic, or any HTTP endpoint you operate. You add a **destination** (how events are delivered), choose which **log types** to include, and Pangolin pushes new events as they are recorded.
|
|
|
|
<Note>
|
|
Event streaming is only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) or self-hosted [Enterprise Edition](/self-host/enterprise-edition).
|
|
</Note>
|
|
|
|
## In the dashboard
|
|
|
|
Open **Organization → Logs & Analytics → Streaming** to add destinations and monitor delivery status. Each destination has its own connection settings, optional body customization (where supported), and log-type selection.
|
|
|
|
## Log types
|
|
|
|
You choose which categories each destination receives. Only log types enabled for your organization can be streamed.
|
|
|
|
<Frame>
|
|
<img src="/images/streaming-log-types.png" alt="Log type selection for a streaming destination" centered />
|
|
</Frame>
|
|
|
|
## Destination types
|
|
|
|
Each destination type has its own configuration and payload behavior. Select **Add destination** and pick a delivery method.
|
|
|
|
<Frame>
|
|
<img src="/images/streaming-add-destination.png" alt="Add destination dialog in the Pangolin dashboard" centered />
|
|
</Frame>
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="HTTP webhook" icon="globe" href="/manage/analytics/streaming/http">
|
|
POST JSON or NDJSON to any URL. Supports custom body templates, authentication, and payload formats for SIEMs and generic webhooks.
|
|
</Card>
|
|
<Card title="Amazon S3" icon="bucket" href="/manage/analytics/streaming/s3">
|
|
Upload batched audit logs to S3 or S3-compatible storage. JSON array, NDJSON, or CSV with optional gzip.
|
|
</Card>
|
|
</CardGroup>
|
|
|
|
### Other destinations
|
|
|
|
Amazon S3 and HTTP webhooks are documented above. For Datadog, Microsoft Sentinel, or other vendor-specific setups, contact [sales@pangolin.net](mailto:sales@pangolin.net).
|
|
|
|
- **No backfill:** New destinations start from the current log cursor. Historical logs already in Pangolin are not replayed.
|
|
- **Per-log-type cursors:** Each enabled log type on a destination is tracked independently.
|
|
- **Errors in the UI:** When delivery fails, the destination's last error is shown in the dashboard so you can fix configuration or endpoint issues. |