Logs and log drains

Platform → Logs shows what happened in a project: every request at the project endpoint, the primary database’s log, auth activity, function invocations and app output.

Sources

Source	What it holds
API	Every request at the project endpoint: method, path, status, duration, role, user, client network
Postgres	The primary database’s log: errors with their SQLSTATE, slow statements, connections
Auth, Data API, Storage, Realtime, Functions, Apps	The requests (and invocations, container output) of that service

Paths are stored without their query string values (only the parameter names), client addresses are truncated to their /24 (IPv6: /48), request bodies are never logged.

Filters

Pick a source and a time range, then filter with field op value, combined with and, or, not and parentheses:

status >= 500
path ~ '/rest/v1/todos' and method = 'POST'
level = 'error' or error_code in ('42P01', '42703')
attributes.query_keys ~ 'select'

Operators: =, !=, >, >=, <, <=, ~ (contains), !~, in (…), not in (…). Text goes in single quotes. The chart counts matching entries per interval by status class, level, service or method. How far back you can look is your plan’s log retention.

Log drains

A drain also sends a project’s logs to:

Kind	Settings	Credential (write-only)
HTTPS endpoint	URL, optional custom header names	header values
Datadog	site (datadoghq.com, datadoghq.eu, …)	API key
Loki	push URL, user	password or token
S3	bucket, region, prefix, optional S3-compatible endpoint, access key id	secret access key

Destinations must be public HTTPS hosts. Credentials are written into your project’s region and never shown again. HTTPS deliveries are JSON arrays signed like Standard Webhooks: verify webhook-signature (v1, + base64 HMAC-SHA256 over webhook-id.webhook-timestamp.body) with the whsec_… secret shown once when you create the drain. A drain that keeps failing drops the batch after three attempts and shows the error. Only owners and admins manage drains, with multi-factor authentication.