> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pangolin.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Log Streaming

> Stream Pangolin log events to external collectors and SIEM tools

<div id="pangolin-toc-cta" className="pangolin-toc-cta-source">
  <Card title="Try free on Pangolin Cloud" icon="cloud" href="https://app.pangolin.net/auth/signup" arrow="true" cta="Sign up free">
    Fastest way to get started with Pangolin using the hosted control plane. No credit card required.
  </Card>
</div>

Log streaming sends your organization’s log events to third-party data collectors such as Datadog, Splunk, or Microsoft Sentinel—often used for SIEM-style monitoring and analysis. You define a destination, a delivery method (for example HTTP, S3, or a vendor-specific integration), and which Pangolin log types to forward: access logs, action logs, connection logs, or request logs. Pangolin pushes events to your external service as they are generated.

<Note>
  Log streaming is only available in [Pangolin Cloud](https://app.pangolin.net/auth/signup) or self-hosted [Enterprise Edition](/self-host/enterprise-edition).
</Note>

## Event Streaming in the dashboard

In the dashboard, this feature appears under Organization → Logs & Analytics → Streaming as Event Streaming. From there you add destinations and configure how events are delivered.

## HTTP destination (example)

The steps below use an HTTP webhook only as an example. Other destination types (object storage, vendor APIs, and so on) follow the same general idea—pick a destination, configure connection details, and choose log types—but the exact fields and options differ by implementation.

### Choose a destination type

Open Add Destination and select how events should be delivered. HTTP webhook is one option; additional destination types may appear over time.

<Frame>
  <img src="https://mintcdn.com/fossorial/MhTcSrnIhCWA52yp/images/streaming-add-destination.png?fit=max&auto=format&n=MhTcSrnIhCWA52yp&q=85&s=b6ab8574d34346eafe7fd813b0034575" centered width="3456" height="1992" data-path="images/streaming-add-destination.png" />
</Frame>

### Configure the connection

On the Settings tab, set a name, the endpoint URL, and authentication (none, bearer token, basic auth, or a custom header). Requests use JSON by default unless you change it elsewhere.

<Frame>
  <img src="https://mintcdn.com/fossorial/MhTcSrnIhCWA52yp/images/streaming-http-settings.png?fit=max&auto=format&n=MhTcSrnIhCWA52yp&q=85&s=af6131194f49601afc8e9e02db6f9491" centered width="3456" height="1986" data-path="images/streaming-http-settings.png" />
</Frame>

### Headers, body, and log types

* **Headers** — Optional custom headers on every request (for example static API keys or a non-default `Content-Type`). By default, `Content-Type: application/json` is sent.
* **Body** — Optionally use a custom JSON body template with variables; you can also choose how batched events are serialized (for example a JSON array versus newline-delimited JSON for tools that expect that format).

<Frame>
  <img src="https://mintcdn.com/fossorial/MhTcSrnIhCWA52yp/images/streaming-http-headers.png?fit=max&auto=format&n=MhTcSrnIhCWA52yp&q=85&s=fb3af8de28f9f70833adfbc3f2cd5e4e" centered width="3456" height="1992" data-path="images/streaming-http-headers.png" />
</Frame>

<Frame>
  <img src="https://mintcdn.com/fossorial/MhTcSrnIhCWA52yp/images/streaming-http-body.png?fit=max&auto=format&n=MhTcSrnIhCWA52yp&q=85&s=18489c9cf67f207cd7a9e8d00125c958" centered width="3456" height="1988" data-path="images/streaming-http-body.png" />
</Frame>

On the Logs tab, choose which log categories are forwarded to this destination. Only log types that are enabled for your organization can be streamed.

<Frame>
  <img src="https://mintcdn.com/fossorial/MhTcSrnIhCWA52yp/images/streaming-log-types.png?fit=max&auto=format&n=MhTcSrnIhCWA52yp&q=85&s=438c3409fb8e997c385519ad34b2c371" centered width="1024" height="590" data-path="images/streaming-log-types.png" />
</Frame>

## Vendor-specific setups

For Amazon S3, Datadog, Microsoft Sentinel, or other provider-specific implementations and guidance, contact [sales@pangolin.net](mailto:sales@pangolin.net).
