Logs and metrics
Every deployment sends its logs to Alien over outbound HTTPS, so your team can search any customer's logs without access to their environment. You can also forward a copy to the tool your on-call already watches.
alien logs --deployment customer-1/us-east-1 --level error --since 1hArchitecture diagram. Deployment (Your code, OpenTelemetry logs) connects outbound to the Alien (Logs search, Health, Log forwarding), via https 443, outbound.
Logs go to the manager, the Alien server that tracks your deployments. Alien hosts it by default. With a private manager, they stay in your own cloud account.
How logs arrive
Alien sets the OpenTelemetry environment variables in your workloads, so any OpenTelemetry SDK sends logs without extra configuration. Alien also collects container output.
Each record carries the deployment it came from. The service name is the resource ID from alien.ts.
The customer chooses the Telemetry setting for each deployment during initial setup, the one-time step their admin runs, from the modes your setup link allows: Automatic, Approval required, or Off. The deployment page shows:
- Logs aren't collected when telemetry is off
- Logs aren't connected yet before the deployment connects
Structured output
Alien parses each captured stdout and stderr line. No configuration is needed. When a line is a JSON object from a common logger (Pino, Winston, Bunyan, Rust tracing-subscriber, Go hclog, python-json-logger, structlog, or Loguru):
- The record's body is the readable message from the JSON.
- Severity comes from the logger's level. Without a recognized level, stderr lines are ERROR and stdout lines are INFO.
- The timestamp comes from the record when it has one, otherwise from capture time.
- All JSON fields, including nested ones, are kept in the
appattribute. - The exact original line is kept in the
log.record.originalattribute.
Plain-text lines pass through unchanged with the stdout or stderr severity. Unrecognized JSON keeps all its fields. Logs your code sends over OpenTelemetry aren't parsed; the SDK sets their severity.
Search in the dashboard
Open Operations → Logs. Filter by deployment, time range (15 minutes to 30 days), and level (Trace to Fatal). The search box accepts:
field:valueand quoted phrasesANDandOR- ranges and comparisons such as
>= IN [...]and field-exists checks
Open a record to see its attributes and raw JSON. Show system components includes logs from Alien's own components.
Search from the CLI
alien logs searches one deployment. With --source, it searches gateway request logs instead: the AI, Encryption, and Sandbox gateways Alien hosts for the customer's AI models and storage and customer-managed keys.
alien logs --deployment customer-1/us-east-1 --since 1h
alien logs --deployment customer-1/us-east-1 --level error --json
alien logs --deployment customer-1/us-east-1 --follow
alien logs --deployment customer-1/us-east-1 -q 'body.message:"timeout"' --since 24h| Flag | Purpose |
|---|---|
--deployment | Deployment ID or <group>/<name>. |
-q, --query | Search text. Default *. |
--level | trace, debug, info, warn, error, fatal. Repeat for several. |
--since, --from, --to | Time window. Default 1h. |
--follow | Keep polling for new records. With --json, prints JSON lines. |
--system | Include Alien system logs, hidden by default. |
--source | ai-gateway, encryption-gateway, or remote-sandbox request logs. |
--status, --operation, --provider, --model, --deployment-group | Filter gateway request logs. Use with --source, without --deployment. |
--status matches the outcome exactly:
- every source:
successorgateway-error ai-gatewayalso:provider-error,cancelledremote-sandboxalso:sandbox-error,outcome-unknown,cancelled
alien logs --source encryption-gateway --status gateway-error --operation decrypt --since 24hGateway request logs hold routing and outcome metadata only: no prompts, model responses, plaintext, or ciphertext.
Metrics and health
Heartbeats, the periodic reports each deployment sends, carry the state of every resource. The deployment page and Operations → Compute show replicas, their health, and CPU and memory where the platform reports them.
Metrics history on the deployment page charts those reports per replica, from the last hour to the last 30 days. See Inventory, and Ready and healthy for how health differs from status.
Forward logs
Send a copy of every deployment's logs to your own tool. Your logs stay searchable in Alien too.
Open Settings → Integrations in your workspace and choose Datadog, Coralogix, Axiom, or Custom OTLP.
Select the project whose logs to forward. Each project has one log destination, and it applies to all its deployments.
Enter the Logs endpoint and the credentials. The endpoint must be HTTPS on port 443 and include the full path, for example https://collector.example.com/v1/logs. You can add up to 16 headers.
Select Forward logs, then Send test log to check the connection.
Pause forwarding and Resume forwarding stop and restart delivery without losing the configuration. Changes take effect within 30 seconds.
Delivery is best effort. Alien retries temporary failures, and an outage at the destination can drop or duplicate records.