> For the complete documentation index, see [llms.txt](https://docs.flowcp.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flowcp.ai/guides/stream-logs.md).

# Stream logs to external sinks

Log streaming forwards your app's MCP execution logs to an external observability system — **DataDog**, **Splunk** (via the HTTP Event Collector), or any **generic HTTP** endpoint — so MCP activity sits alongside the rest of your telemetry. Each app can have multiple destinations, and only privacy-safe fields are sent.

Log streaming is an **Enterprise** feature. When it is enabled for your workspace, a **Log streaming** entry appears in the app sidebar.

Because a destination forwards execution logs to an external endpoint with a credential you provide, **only workspace owners can add, edit, or remove destinations**. Members can view the current configuration but not change it.

## Adding a destination

1. Open your app and click **Log streaming** in the sidebar.
2. Click **Add destination** and fill in:
   * **Name** — a label so you can tell destinations apart (e.g. "DataDog prod").
   * **Destination** — DataDog, Splunk (HEC), or Generic HTTP.
   * **DataDog site** *(DataDog only)* — the intake site for your DataDog account (`datadoghq.com`, `datadoghq.eu`, `us3.datadoghq.com`, etc.). It must match the site shown in your DataDog URL.
   * **Endpoint URL** *(Splunk / Generic HTTP)* — the `https://` endpoint to POST to. For Splunk, enter your HEC base URL — `/services/collector` is appended automatically.
   * **Auth header name** *(Generic HTTP only, optional)* — leave blank to send `Authorization: Bearer <token>`, or set a custom header (e.g. `X-API-Key`) to send the raw token instead.
   * **API key / token** — the DataDog API key, Splunk HEC token, or bearer token for your HTTP endpoint.
   * **Only forward errors** / **Minimum status code** — optionally restrict which calls are forwarded (e.g. errors only, or status ≥ 500).
3. Leave **Enabled** on, then click **Create sink**.

### Where to get the credential

* **DataDog** — Organization Settings → API Keys.
* **Splunk** — Settings → Data inputs → HTTP Event Collector → New Token.
* **Generic HTTP** — whatever token your collector expects.

## What gets sent

Only the privacy-safe fields from the [Execution logs](/reference/execution-logs.md) are forwarded — never tokens, request/response bodies, or authorization headers. Each record includes the tool name, status code, latency, error code, the MCP client name/version, the LLM model (when reported), a hashed end-user key, and the timestamp.

Only **published** servers are streamed — draft and disabled servers do not generate forwarded logs.

## How delivery works

FlowCP polls for new execution logs in the background and delivers them in batches roughly once a minute, so expect up to about a minute of latency. Each destination tracks its own position, so a destination added today only forwards logs created from that point on — it does not backfill history. Failed batches are retried automatically; if delivery keeps failing, the destination shows a **Delivery error** with the latest message.

For your security, the API key/token is encrypted at rest and never shown again once saved. When editing a destination, the secret field shows **Configured** — paste a new value to replace it, or click **Remove** to clear it.

Endpoint URLs are validated to block private and reserved network ranges, so a destination can only ever reach a public host.

## Editing and removing

Click **Edit** on a destination to change its settings or filters, or toggle **Enabled** to pause streaming without deleting it. Click the trash icon to remove a destination entirely.