Log exports — EnclaveStack

Overview

A log export sends your apps’ and services’ logs somewhere else as they happen, so you can keep them longer or search them in a tool you already use.

When to use it

Keep logs longer than the machine does.
Search all logs in one place.
A copy for audits.

How it works

Shipper: Follows every container of each source from the engine’s logs, with a checkpoint per container.
Destinations: A bucket (gzip files of JSON lines), any S3, HTTP, OpenTelemetry (OTLP/HTTP) or Grafana Loki.

A batch is recorded as sent only once the destination accepts it, so lines arrive at least once. If the engine rotated lines away before they were sent, the export records the gap.

Architecture

The shipper follows container logs and sends batches on.

Flows

Exporting to a bucket

Create the export with a bucket folder.
Every minute a compressed file of new lines arrives.
The page shows lines sent and any error.

Set it up

In the console

Open Log exports and choose New log export.
Choose where logs go and which resources.
Add a filter if you want only some lines.

With the CLI

enclave logexport create archive --bucket uploads/logs --wait

With OpenTofu

OpenTofu configuration

resource "enclave_log_export" "archive" {
  name   = "archive"
  bucket = { bucket = "uploads", prefix = "logs" }
}

Settings reference

Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.

`enclave_log_export`
Name	Type	Use	What it does
`name`	text	required	Name of the log export: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the log export.
`bucket`	list of objects	optional	A bucket of the project: gzip files of JSON lines.
`filter`	text	optional	Only lines matching this regular expression are sent.
`flush_seconds`	number	optional	How often batches go (5–300; default 10, or 60 for buckets).
`http`	list of objects	optional	JSON lines POSTed to a URL.
`loki`	list of objects	optional	Grafana Loki's push API.
`otlp`	list of objects	optional	An OpenTelemetry (OTLP/HTTP) logs endpoint.
`project`	text	optional	The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
`s3`	list of objects	optional	Any S3-compatible bucket.
`sources`	list of text	optional	Resources as "kind/name" (default every resource of the project with logs).
`id`	text	output	Resource ID.
`last_sent_at`	text	output	When a batch last went.
`lines_sent`	number	output	Lines sent so far (refreshed on read).

Limits and security

Good to know

Batches every 10 seconds (60 for buckets) unless you choose.

Security

Secrets never appear in logs, so never in exports; headers for destinations come from a secret.