Guide
Integrations
Ready-made integrations for software you run yourself and the cloud services you use. Pick one under Integrations in the app, answer a few questions, and run the one command or paste the one address it gives you. Each integration has its own guide: what you answer, the exact setup steps, how to check that data arrives, and the dashboard, parser and alerts it comes with.
How integrations reach Logthread#
- Nothing connects into your network. Logthread never logs in to your servers or databases, and you open no inbound ports, VPN or public access.
- Agent integrations install the Logthread Agent on the machine that runs the software, or on one that can reach it over your private network. The agent reads logs and metrics locally and sends them over outbound HTTPS (port 443) to
ingest.logthread.com. - App integrations are a few settings in your own app. It sends over the same outbound HTTPS connection, with no agent to install.
- Cloud integrations (AWS, Cloudflare, Vercel, Heroku) use the service's own log delivery: you paste a Logthread address and key into it once, and it sends the logs over HTTPS. Nothing is installed, and Logthread never signs in to your cloud account.
- Polled integrations (Okta, GitHub) take a read-only API token, stored encrypted; Logthread reads the audit log every 5 minutes and changes nothing in your account.
- Every integration has its own ingest key. The key can send data but never read it. It is filled in to the command and shown once. Removing the integration revokes the key.
- Database integrations read with a monitoring login that you create, with the grants shown in the setup, and never read your table data.
- AI agents can set them up too. With MCP, an agent runs
list_integrations,add_integrationandget_integration.
Platform integrations work differently: LiveKit sends webhooks, so see the LiveKit collector pack. For anything else, see Send data (OpenTelemetry, Fluent Bit, syslog, HTTP).
All integrations#
| Integration | What it sends | How data is sent | Runs on |
|---|---|---|---|
| Exchange Server (beta) | Exchange Server events: every management cmdlet with its caller, and transport, store, search, ActiveSync and OWA service events. | Logthread Agent | Windows Server |
| Java applications (beta) | Logback, Log4j and Spring Boot log files, parsed on the host with stack traces kept whole; add the OpenTelemetry Java agent for traces. | Logthread Agent | Linux |
| AWS (CloudWatch Logs and Firehose) (beta) | CloudWatch Logs from Lambda, ECS and any log group, or any Firehose stream. | The service sends its logs (HTTPS, nothing to install) | AWS (CloudWatch Logs and Firehose) |
| Cloudflare (beta) | HTTP requests and firewall events from Logpush: status, cache, origin time, clients. | The service sends its logs (HTTPS, nothing to install) | Cloudflare |
| Google Cloud (beta) | Cloud Logging from Cloud Run, GKE, Cloud Functions, App Engine, Compute Engine and audit logs through a Pub/Sub push subscription. | The service sends its logs (HTTPS, nothing to install) | Google Cloud |
| Heroku (beta) | App, router and platform logs: status, response time and H, R and L error codes. | The service sends its logs (HTTPS, nothing to install) | Heroku |
| Microsoft Azure (beta) | Azure Monitor: the activity log, resource diagnostic logs, App Service and Functions logs, and Microsoft Entra ID sign-in and audit logs, streamed through an Event Hub. | Logthread Agent | Linux |
| Vercel (beta) | Function, edge, build, static and firewall logs from Vercel Log Drains. | The service sends its logs (HTTPS, nothing to install) | Vercel |
| Docker and Podman (beta) | Every container's logs, and CPU, memory and network per container. | Logthread Agent | Linux |
| Kubernetes (beta) | Pod logs with their namespace and pod, node and pod CPU and memory, restarts and deployment health. | Logthread Agent | Kubernetes |
| Elasticsearch (beta) | Cluster health, shards, indexing and search rates, JVM heap, rejections and the log. | Logthread Agent | Linux |
| Microsoft SQL Server (beta) | Performance metrics, the slowest statements with waits and blocking, and the ERRORLOG. | Logthread Agent | Windows Server, Linux |
| MongoDB (beta) | Operations, document changes, connections, memory, network and the server log. | Logthread Agent | Linux |
| MySQL and MariaDB (beta) | Row operations, threads, buffer pool, locks, temporary tables and the error log. | Logthread Agent | Linux |
| PostgreSQL (beta) | Connections, commits, rollbacks, deadlocks, cache reads, sizes and the server log. | Logthread Agent | Linux |
| Redis (beta) | Commands, hits and misses, memory, clients, evictions, keys and the server log. | Logthread Agent | Linux |
| Active Directory (beta) | Domain controller events: directory service and replication, DNS Server, DFS Replication and AD Web Services. Add Windows Security for logons. | Logthread Agent | Windows Server |
| GitHub (beta) | The organization audit log: repository, member, team, secret, workflow and settings changes, read every 5 minutes with a read-only token (GitHub Enterprise Cloud). | Logthread reads the API with a token you create (nothing to install) | Your app |
| Okta (beta) | The Okta System Log: sign-ins, MFA, password and lifecycle events, and admin changes, read every 5 minutes with a read-only token. | Logthread reads the API with a token you create (nothing to install) | Your app |
| Apache Kafka (beta) | Consumer group lag, offsets, partitions and replicas in sync, and the broker log. | Logthread Agent | Linux |
| RabbitMQ (beta) | Messages ready and unacknowledged, publish and deliver rates, consumers and the log. | Logthread Agent | Linux |
| Fluent Bit (Loki output) | Fluent Bit's loki output, pointed at Logthread. | Settings in your app | Your app |
| Grafana Alloy (Loki) | Send the logs Alloy already collects with a loki.write endpoint. | Settings in your app | Your app |
| Prometheus remote write | Prometheus 2.x and 3, Grafana Agent and vmagent: remote write 1.0 and 2.0. | Settings in your app | Your app |
| Promtail | Keep Promtail and its scrape configs; push to Logthread instead of Loki. | Settings in your app | Your app |
| Linux host (beta) | Load, memory, disks, filesystems, network and processes, and the systemd journal. | Logthread Agent | Linux |
| Pipecat (beta) | Every call as a trace: turns, response latency, interruptions, and STT, LLM and TTS timing and tokens. | Settings in your app | Your app |
| Apache httpd (beta) | Requests, traffic, workers and connections, and every access and error log line. | Logthread Agent | Linux |
| IIS (beta) | Every request with status, latency and bytes, plus IIS and Windows Server metrics. | Logthread Agent | Windows Server |
| NGINX (beta) | Requests and connections, and every access and error log line with status and path. | Logthread Agent | Linux |
Next: find what your integration sends in Explore and live tail.