Skip to main content
A log drain forwards one stream of workspace events to an HTTPS endpoint or Axiom dataset you control. When you create a drain, you pick the stream: Audit logs, Key verifications, Gateway HTTP requests, Runtime logs, or Rate limits. Use drains to keep history past plan retention, feed a SIEM, or alert on events such as key.delete or 5xx gateway responses.
Every plan starts with a Log drains limit of 0, so Settings > Log Drains won’t let you create one yet. Ask support@unkey.com to raise the limit for your workspace.

Streams

Each drain sends exactly one stream. Create another drain if you need a second stream or destination. Leave a filter empty to send every value for that filter, including ones added later. When you set more than one filter on a stream, an event must match all of them. Filter changes apply from the drain’s current position. They do not replay events that an earlier filter skipped.

Audit log event types

Specific event types opens a category tree, such as key. Expand a category to see full event names such as key.create. Checking a category selects the event types listed under it today. Event types added to that category later aren’t included, so choose All event types if you want them.

Gateway and runtime log sources

The gateway HTTP requests and runtime logs streams filter by Sources:
  • All sources covers every current and future resource in the workspace.
  • Specific sources limits the drain to the projects, apps, and environments you pick. Picking a whole project or app also covers environments added to it later. Picking individual environments doesn’t.

How delivery works

Unkey sends events in batches shortly after they happen. A delivery only counts once your destination accepts the whole batch. For HTTP, that means a 2xx response within 30 seconds. If a delivery fails, Unkey retries the same batch. Because of retries, your destination can receive the same event more than once. Use the stream’s ID field to drop duplicates. The table also shows how long Unkey keeps each stream, which limits how far a paused or failing drain can catch up. A new drain only sends events that happen after you create it. Earlier events aren’t backfilled. After a pause or a failure, delivery picks up where it stopped, as long as those events are still within the stream’s retention.

Destinations

destination
Unkey posts batches to an HTTPS URL you provide. Don’t put a username or password in the URL. Use a header instead. Under Encoding, pick JSON (an array of events per request), NDJSON (one event per line), or HEC (Splunk HTTP Event Collector and compatible sinks such as CrowdStrike NG-SIEM). HEC wraps each event as time, source (unkey), sourcetype (the stream name), and event, and treats the delivery as successful when the response is 2xx with an empty body or HEC code 0. Add up to 32 unique headers, such as an Authorization header your endpoint checks. Names can be up to 256 characters and values up to 8192. Header values are stored encrypted and never shown again after you save.
destination
Unkey sends events to an Axiom dataset you name, using an Axiom API token you provide. The token is stored encrypted.

Create a drain

1

Choose the destination

Under Settings > Log Drains, click Create Log Drain and pick HTTP or Axiom.
2

Name it and pick a stream

Give it a name (shown in the list and on the drain page). Under Stream, choose Audit logs, Key verifications, Gateway HTTP requests, Runtime logs, or Rate limits. Optionally set that stream’s filters.
3

Enter destination settings

For HTTP, set the URL, encoding (JSON, NDJSON, or HEC), and optional headers. For Axiom, set the dataset and API token. Then click Create Log Drain.
New Log Drain panel with HTTP selected, a name field, the Audit logs stream, event type options, the URL and encoding fields, and optional headers
4

Watch the first deliveries

Delivery is asynchronous and can take a few minutes. The drain’s detail page shows delivered and failed batches over the past 24 hours, the success rate, and the most recent delivery attempts. Failed attempts include your endpoint’s response.
Log drain detail page with Delivered, Failed, and Success rate cards for the past 24 hours, and a Deliveries table listing each attempt's time, status, events, latency, and response, including a failed 503 attempt
Admins and developers can both create, edit, pause, and delete drains.

Edit a drain

Open the drain and click Settings to change its name, filters, or destination settings. The stream and the destination type can’t be changed. Create a new drain instead.
Log drain Settings panel with the name, a disabled Audit logs stream field, event type options, the URL and encoding fields, and an Add header button

Pause a drain, or fix a failing one

A drain shows one of three states:
  • Running: it’s delivering, or retrying after failures.
  • Paused (paused_by_user): someone chose Pause deliveries from the drain’s actions menu. Choose Resume deliveries to pick up where it stopped, including events that arrived in between (within retention).
  • Failing (paused_by_failure): 50 attempts in a row failed and Unkey stopped trying. Fix the destination, then choose Resume deliveries. Saving a change to the drain’s filters or destination also resumes it.
Between failed attempts, the wait doubles from one minute up to about two hours, then stays at four hours. A dead endpoint takes about a week to reach 50 failures. If the destination sends a longer Retry-After, Unkey waits that long instead, up to 24 hours.

Delete a drain

Deleting a drain stops all deliveries and removes its settings. Events already delivered stay where you sent them. Events not yet delivered aren’t sent.
Last modified on November 3, 2026