> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.com/ovh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Observability & Monitoring > Collect logs, metrics, and traces from your OVHcloud infrastructure using Logs Data Platform and Metrics. OVHcloud provides a fully managed observability stack built around **Logs Data Platform (LDP)** — a log management service powered by OpenSearch and Graylog. You can ingest logs from any source, store them with configurable retention, build dashboards, and trigger alerts, all without managing the underlying infrastructure. Manage your LDP account, streams, and dashboards in the Control Panel. Query and visualise logs in real time using Graylog. Full guide catalogue for Logs Data Platform. ## What is Logs Data Platform? Logs Data Platform (LDP) is OVHcloud's fully managed log management solution. It ingests logs from your infrastructure and applications, indexes them for fast querying, and exposes them through multiple interfaces: a Graylog web UI, the OpenSearch API, OpenSearch Dashboards, and Grafana. LDP handles all scaling automatically. There is no limit on how many logs a stream can store, and indexed logs are immutable — once ingested, a log entry cannot be modified or individually deleted before the configured retention period expires. ### Key concepts | Concept | Description | | --------------- | -------------------------------------------------------------------------------------------------------------------------- | | **LDP Service** | Your top-level tenancy unit within LDP. Identified by a name like `ldp-xy-98765`. | | **Data stream** | A logical partition of logs. Each stream has a unique write token. Configure retention, archival, and alerting per stream. | | **Index** | An OpenSearch index. Use when you need direct OpenSearch API access for custom data or enrichment. | | **Alias** | A virtual index mapping one or more streams or indices. Required by tools like Grafana or OpenSearch Dashboards. | | **Input** | An ingestion endpoint. Mutualized inputs are shared; dedicated inputs (Logstash, Flowgger) are provisioned on demand. | ### Supported log formats LDP accepts logs in several formats over TCP, TCP+TLS, or UDP: | Format | Port (TLS) | Port (TCP) | | ---------------------------- | ---------- | ---------- | | Syslog RFC 5424 | 6514 | 514 | | GELF | 12202 | 2202 | | LTSV (null delimiter) | 12200 | 2200 | | LTSV (line delimiter) | 12201 | 2201 | | Cap'n'Proto | 12204 | 2204 | | Beats (Filebeat, Metricbeat) | 5044 | — | The cluster address is shown on your LDP service home page. ## Setting up your first log stream Open the [Logs Data Platform](https://www.ovh.com/manager/#/logs-data-platform) page in the OVHcloud Control Panel. If you do not have an LDP account yet, order one — there is no charge to activate the service. You pay only for usage (storage, retention, and optional dedicated inputs). When setting up your account, enable **OVHcloud IAM** as the authentication method. This is the recommended approach and allows you to control access using IAM policies. On the LDP control panel home page, click **Add data stream** in the **Data streams** panel. Configure the stream: * **Name** — a descriptive name for the stream (e.g. `production-app-logs`) * **Description** — optional context about what this stream contains * **Retention** — choose how long to keep indexed logs: 14 days, 1 month, 3 months, or 1 year. This cannot be changed after creation. * **Limit** — optionally set a maximum storage size to control costs Click **Save**. The stream is created immediately. On the **Data streams** page, click the **...** menu next to your stream and select **Copy the write token**. This `X-OVH-TOKEN` value authenticates log writes to this stream. Test the stream by sending a GELF-formatted log using `openssl`: ```bash theme={null} echo -e '{"version":"1.1","_X-OVH-TOKEN":"","host":"my-server","short_message":"Test log from setup","timestamp":'"$(date +%s)"',"level":6}'\0 | \ openssl s_client -quiet -no_ign_eof -connect .logs.ovh.com:12202 ``` Replace `` with the stream token and `` with the cluster address from your LDP home page. On the **Data streams** page, click **...** > **Graylog access** next to your stream. Log in using your OVHcloud credentials. Your test log should appear in the stream view within a few seconds. Use the search bar to filter logs. For example, to search for all logs from `my-server`: ```text theme={null} host:my-server ``` ## Data input methods ### Fluent Bit (Kubernetes) [Fluent Bit](https://fluentbit.io/) is a lightweight log forwarder well suited to Kubernetes environments. Deploy it as a DaemonSet to collect logs from all pods in your cluster. ```bash theme={null} kubectl create namespace logging kubectl --namespace logging create secret generic ldp-token \ --from-literal=ldp-token= ``` Add the following to your `values.yaml` for the Fluent Bit Helm chart: ```yaml env and filters theme={null} env: - name: FLUENT_LDP_TOKEN valueFrom: secretKeyRef: name: ldp-token key: ldp-token config: filters: | [FILTER] Name kubernetes Match kube.* Merge_Log On Keep_Log Off K8S-Logging.Parser On K8S-Logging.Exclude On [FILTER] Name record_modifier Match * Record X-OVH-TOKEN ${FLUENT_LDP_TOKEN} [FILTER] Name nest Match * Wildcard pod_name Operation lift Nested_under kubernetes Add_prefix kubernetes_ [FILTER] Name modify Match * Copy kubernetes_pod_name host [FILTER] Name modify Match * Add log "none" ``` ```yaml output theme={null} config: outputs: | [OUTPUT] Name gelf Match kube.* Host .logs.ovh.com Port 12202 Mode tls tls On Compress False Gelf_Short_Message_Key log ``` Replace `` with the cluster address from your LDP home page. ```bash theme={null} helm repo add fluent https://fluent.github.io/helm-charts helm upgrade --install --namespace logging -f values.yaml fluent-bit fluent/fluent-bit # Verify pods are running kubectl get pods --namespace logging ``` ### Logstash (dedicated input) For more complex log transformation pipelines, you can provision a managed Logstash instance on LDP. This is useful when you need to parse, filter, or enrich logs before ingestion. ```ruby logstash.conf (basic) theme={null} input { tcp { port => 5000 type => syslog } } filter { grok { match => { "message" => "%{SYSLOGBASE}" } } date { match => ["timestamp", "MMM dd HH:mm:ss"] target => "timestamp" timezone => "Europe/Paris" } } output { gelf { host => ".logs.ovh.com" protocol => "TCP" port => 2202 custom_fields => ['X-OVH-TOKEN', ''] } } ``` ```ruby logstash.conf (file input) theme={null} input { file { path => ["/var/log/app/*.log"] start_position => "beginning" sincedb_path => "/var/lib/logstash/sincedb" type => "application" } } filter { if [type] == "application" { grok { match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:msg}" } } } } output { gelf { host => ".logs.ovh.com" protocol => "TCP" port => 2202 custom_fields => ['X-OVH-TOKEN', ''] } } ``` To provision a dedicated Logstash input on LDP, go to **Data-gathering tools** in the LDP control panel and click **Add input**. ### Filebeat [Filebeat](https://www.elastic.co/beats/filebeat) ships logs from files to LDP using the Beats protocol (port 5044): ```yaml theme={null} output.logstash: hosts: [".logs.ovh.com:5044"] ssl.enabled: true ssl.certificate_authorities: ["/etc/ssl/certs/ldp.pem"] ``` Download the LDP SSL certificate from the **Home** page of your LDP service under **SSL Configuration**. ### VPS and dedicated servers (syslog) For Linux servers, configure `syslog-ng` or `rsyslog` to forward system logs to LDP over TCP+TLS using RFC 5424 format. Detailed configuration examples are available in the [syslog-ng guide](https://help.ovhcloud.com/csm/en-gb-logs-data-platform-ingestion-syslog-ng). ## Log forwarding from OVHcloud services Many OVHcloud services support native log forwarding directly to an LDP stream. This allows you to centralise infrastructure logs without deploying any additional agent. ### Setting up log forwarding Each service that supports log forwarding uses a subscription model. You create a subscription linking the service to one of your LDP streams. For example, to forward IAM audit logs: ```bash theme={null} POST /me/logs/audit/log/subscription ``` ```json theme={null} { "streamId": "ab51887e-0b98-4752-a514-f2513523a5cd", "kind": "default" } ``` Available log forwarding APIs: | Source | API | | ------------------------------------------------- | -------------------------------------- | | Audit logs (login, password changes) | `POST /me/logs/audit/log/subscription` | | Activity logs (all API and Control Panel actions) | `POST /me/api/log/subscription` | | IAM access policy evaluations | `POST /iam/log/subscription` | Log forwarding activation is free. You are charged only for storage in your LDP stream at standard LDP pricing. ## Metrics and dashboards LDP exposes your indexed log data through multiple visualisation tools. ### Graylog dashboards In Graylog, you can build dashboards directly from search results. For example: 1. In your stream, search for `some_metric_num:>30`. 2. On the left panel, expand the `user_id` field and select **Show top values**. 3. Click **Copy to Dashboard** to add the widget to an existing or new dashboard. Graylog dashboards are interactive — they update in real time and support filtering using the top search bar. ### OpenSearch Dashboards For more advanced visualisations and index pattern management, you can provision a managed OpenSearch Dashboards instance on LDP. Go to the **OpenSearch Dashboards** tab in the LDP control panel and click **Add**. OpenSearch Dashboards connects to your LDP data via aliases. Create an alias that maps to your stream, then configure it as an index pattern in OpenSearch Dashboards. ### Grafana OVHcloud Public Cloud includes a managed Grafana service. You can connect Grafana to LDP's OpenSearch API endpoint (port 9200) to query logs alongside other metrics. Configure the Grafana datasource with: * **URL**: `https://.logs.ovh.com:9200` * **Auth**: Use your LDP credentials or an IAM-issued token * **Index name**: the alias name that maps to your streams ## Alerting on log patterns LDP supports three types of stream alerts, all configured from the stream's **Manage alerts** menu in the control panel: | Alert type | Use case | | --------------------- | ------------------------------------------------------------------------------------------------------ | | **Message count** | Alert when the number of logs drops below or exceeds a threshold (e.g. detect a stopped application) | | **Field aggregation** | Alert on numeric field statistics — mean, min, max, sum, standard deviation (e.g. slow response times) | | **Field content** | Alert when a specific field contains an exact value (e.g. HTTP 500 errors) | All alert types support a **grace period** to prevent repeated notifications for the same condition. ### Example: alert on HTTP 500 errors In the stream's alert management interface: 1. Click **Create an alert** and select **Field content**. 2. Set the field name to `status_int` and value to `500`. 3. Set a grace period (e.g. 5 minutes) to avoid alert spam. 4. Click **Save**. When the condition is triggered, LDP sends an email with the matching log messages included. ## IAM logs forwarding (audit trail) Forwarding IAM account logs to LDP creates a complete audit trail of all account activity. This is essential for security monitoring and compliance. Three types of account logs are available: **Audit logs** record security-relevant events: | Field | Description | | ------------------------------ | ------------------------------------------------------------- | | `account` | OVHcloud account affected | | `authDetails_userDetails_type` | `ACCOUNT` (root), `USER` (local), or `PROVIDER` (federated) | | `loginSuccessDetails_mfaType` | MFA method used: `NONE`, `SMS`, `TOTP`, `U2F`, etc. | | `type` | Event type: `LOGIN_SUCCESS`, `ACCOUNT_PASSWORD_CHANGED`, etc. | **Access policy logs** record IAM evaluation results: | Field | Description | | ---------------------------- | --------------------------------- | | `identities_array` | URNs of the user and their groups | | `requested_actions_array` | Actions the user attempted | | `authorized_actions_array` | Actions IAM allowed | | `unauthorized_actions_array` | Actions IAM denied | To find all IAM denials for a user named `ines` in Graylog: ```text theme={null} identities_array:*ines* AND unauthorized_actions_array:* ``` See [IAM — Enabling IAM logs forwarding](/manage/iam#enabling-iam-logs-forwarding) for how to set up subscriptions. ## Shared responsibility model OVHcloud and you share responsibility for the observability stack: | Responsibility | Customer | OVHcloud | | --------------------------------------------------------------------------- | -------- | -------- | | Install, configure, and maintain LDP platform components | | RA | | Order and configure streams, set retention policies | RA | I | | Install and configure log forwarder agents (Fluent Bit, Logstash, Filebeat) | RA | | | Manage data confidentiality and integrity | RA | | | Monitor LDP service performance and infrastructure | | RA | | Handle LDP platform patches and upgrades | I | RA | | Ensure external tools remain compatible with LDP updates | RA | | | Define and maintain business continuity plan for logs | RA | I | Logs stored in streams are immutable. Individual log entries cannot be modified or deleted before the configured retention period expires. You can delete an entire stream, but not individual messages. ## Next steps Automate LDP stream creation and management using the Terraform OVH provider. Control access to your LDP streams using IAM policies.