Log Drains & Webhook Egress

The Pocket Kit Log Drains Engine allows enterprise developers and operators to forward real-time logs, error events, and database mutations from their PocketBase instances to external observability, SIEM, and alerting platforms.

---

Supported Destinations

Pocket Kit includes native payload formatters and integration presets for:

• Datadog Logs API: Ingests events conforming to Datadog v2 JSON schema with custom tags (service:pocketbase, env:production) and hostname attribution.
• Axiom: Stream structured JSON log batches directly into your Axiom dataset.
• Better Stack (Logtail): Stream events with token authorization headers and microsecond timestamps.
• Slack Incoming Webhooks: Rich interactive mrkdwn alert cards for instant notification when panics or errors occur.
• Discord Webhooks: Color-coded embedded feeds for monitoring instance health.
• Custom HTTPS Webhooks: Standard JSON egress with optional SHA-256 HMAC payload signatures in X-Fuko-Signature.

---

Non-Blocking Architecture

Log Drains run 100% asynchronously using PocketBase’s $http.send API inside background event hooks:

// Automatically injected into /tenants/<id>/pb_hooks/log_drain_egress.pb.js
onRecordAfterCreateRequest((e) => {
  try {
    $http.send({
      url: "http://127.0.0.1:8090/api/log-drains/ingest",
      method: "POST",
      body: JSON.stringify({
        instance_id: e.record.id,
        level: "info",
        event_type: "record_create",
        message: "New record created in " + e.record.collection().name,
        details: { collection: e.record.collection().name, id: e.record.id }
      }),
      headers: { "Content-Type": "application/json" },
      timeout: 3
    });
  } catch (err) {
    // Non-blocking: failures never interrupt user database operations
  }
});

---

Filtering & Configuration

When configuring a Log Drain, you can customize:

1. Target Instance: Scope the forwarder to a specific PocketBase instance or apply globally across all your tenants.
2. Minimum Log Level:
   • All Events: Info, debug, warnings, and error events.
   • Warning & Above: Warnings and error logs.
   • Error & Fatal Only: Only 500 errors, panics, and failed database operations.
3. HMAC Signature Verification: When configured, Pocket Kit signs every payload with HMAC-SHA256(secret, payload) and includes the signature in the X-Fuko-Signature header.
4. 1-Click Test Dispatch: Test any endpoint directly from the console to verify HTTP response codes and measure round-trip latency in milliseconds.