Log drains

Add a drain for one app

1. Open Settings › Log drainsOn the app, open the Settings tab and choose Log drains.
2. Fill in the formA Name, the Endpoint URL, the Format (NDJSON (one record per line) or JSON array), Sampling (% of log lines), and the Sources: Build logs, Runtime logs and Deploy events.
3. Add a custom header if your service needs oneFor example DD-API-KEY and its value.
4. Select Add drainCopy the signing secret now. AOZUMI does not show it again.

The endpoint must be a public https:// URL on the standard port. Private and reserved addresses are refused. Changes apply to new log lines, with no deploy.

Each drain shows its last delivery. Use Send test event to check the endpoint, Pause and Turn on to stop and start it, and Remove… to delete it.

Only workspace owners and admins can add or change log drains.

Add a drain for every app

Open Settings › Integrations › Workspace log drains and select Add workspace drain. The form is the same. A workspace drain covers every app in the workspace, including apps added later.

An app's own Log drains section lists workspace drains under From the workspace, read-only, with a link to manage them. A workspace can have up to 20 drains in all.

What your endpoint receives

AOZUMI sends POST requests with batches of records, up to 500 records or 256 KB each. Every record is one log line, as the console shows it, or one deploy event.

{"id":"…","timestamp":"2026-11-01T09:30:12.000Z","source":"runtime","message":"GET /api/orders 200","workspaceId":"…","applicationId":"…","applicationSlug":"atlas","deploymentId":"…","environmentId":"…"}

• source is build, runtime, deploy or test.
• Deploy events also carry status, such as live, failed or cancelled.
• Sampling keeps the same share of lines on every retry. Deploy events and test events are never sampled away.

Verify a delivery

Each request carries X-Aozumi-Signature: sha256=…, an HMAC-SHA256 of the exact request body with the drain's signing secret. Check it before you parse the body.

import { createHmac, timingSafeEqual } from "node:crypto";

// body: the raw request body as a Buffer, before JSON parsing.
export function verify(body, header, secret) {
  const expected = "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(header ?? "");
  return a.length === b.length && timingSafeEqual(a, b);
}

Retries and failures

AOZUMI retries a failing endpoint with backoff. After 5 batches in a row fail every retry, it turns the drain off and shows the reason on the drain. The workspace gets a Log drain turned off notice in Notifications, which alert channels can receive too. Fix the endpoint, then select Turn on.

Questions

Can I send every app's logs to one place?

Yes. Add a workspace log drain under Settings › Integrations. It covers every app in the workspace, including apps added later.

Why did my log drain turn off?

AOZUMI retries a failing endpoint with backoff, and turns the drain off after 5 batches in a row fail every retry. You get a Log drain turned off notice. Fix the endpoint, then select Turn on.

Are secrets sent to my log drain?

Drains receive the same lines the console shows, which are already redacted.