Export logs over OTLP
Organization owners and admins on Pro or Enterprise can send the organization’s logs to their own OpenTelemetry-compatible log tool, for example Datadog, Grafana or Splunk. yggy keeps its own copy either way.
Set up the export
Section titled “Set up the export”- Open Security → Log export.
- Enter the OTLP HTTP endpoint: the
/v1/logsendpoint of your OpenTelemetry collector. - Optionally set the Service name, Service namespace and Environment that mark the records.
- Add the Request headers your collector needs, such as an authorization header, one
Name: valueper line. yggy encrypts the values and never shows them again; the page lists only the names. Headers you enter later replace the stored ones, and a blank field keeps them. - Choose the Streams: Audit events, API requests, or both. At least one is required.
- Save.
An organization has one export destination. Remove stops the export.
How the destination is checked
Section titled “How the destination is checked”yggy checks the endpoint when you save and again before every delivery. It must:
- be a valid URL that ends in
/v1/logs, - use HTTPS,
- not contain a user name or password,
- resolve to a public address, not a private or local one.
yggy connects to the address it checked and does not follow redirects. Your collector must answer with a 2xx status within 5 seconds, or the delivery counts as failed.
You can add up to 20 headers. Header names may use only letters, digits and the punctuation HTTP allows in header names, such as -, _ and .. A value can be up to 4096 characters, on one line. Content-Type, Content-Length, Host, Connection and Transfer-Encoding are set by yggy and cannot be added.
The two streams
Section titled “The two streams”| Stream | What it holds | Delivery |
|---|---|---|
| Audit events | The organization’s audit events, such as sign-ins, API keys, member and role changes, providers and MCP actions | With retries, so a short outage on your side delays events. |
| API requests | One record per request in Request logs | Best effort: yggy sends each batch, tries once more after 2 seconds, then drops it. An outage on your side can leave gaps. The requests stay in Developers → Usage and logs for 30 days. |
For the API requests stream, Security → Log export shows when the last export ran and how many records it sent, or that it failed.
What each record holds
Section titled “What each record holds”Both streams send OTLP log records as JSON over HTTP. Each batch names its source in the resource attributes:
| Attribute | Value |
|---|---|
service.name | Audit events: the service name you set (default audit). API requests: always api-requests. |
service.namespace | The service namespace you set (default yggdrasil). |
service.version | The yggy version. |
deployment.environment.name | The environment you set, when set. |
organization.id | Your organization id. |
Audit event records
Section titled “Audit event records”The severity is INFO for a success, WARN for a partial result and ERROR for a failure. The event name is the audit event type. The body is JSON with eventType, action, result and metadata. Attributes without a value are left out.
| Attribute | Value |
|---|---|
log.record.uid, audit.event_id | The audit event id |
audit.event_type | The event type |
audit.action | What was done |
audit.result | success, partial or failure |
audit.resource.type, audit.resource.id | What it was done to |
audit.actor.id, audit.actor.type | Who did it |
audit.organization.id | Your organization id |
client.address | The client IP, when known |
user_agent.original | The user agent, when known |
API request records
Section titled “API request records”The event name is api.request. The severity is ERROR for a 5xx status, WARN for a 4xx status and INFO otherwise. Attributes without a value are left out.
| Attribute | Value |
|---|---|
http.request.method | The HTTP method |
http.route | The route the request matched |
http.response.status_code | The status code |
client.address | The client IP |
yggy.request.id | The request ID, the same as the x-request-id response header |
yggy.credential.kind | api_key_user (personal key), api_key_org (organization key) or oauth (connected app) |
yggy.credential.id | The id of the key or app |
yggy.user.id | The member the request acted as |
yggy.error.code | The error code of a failed request |
yggy.mcp.method, yggy.mcp.tool | The MCP method and tool, for MCP requests |
yggy.latency_ms | The response time in milliseconds |