# Forward audit events

> Source: https://elaichi.ai/docs/guides/settings/logging/

Forward this organization’s MCP tool calls, authentication changes, and administration events to your own observability stack. Sign-in events that happen outside an organization context are not forwarded.

**Where to find it:** **Settings → Logging**

You need **Manage logging** (`logging:manage`). The Logging tab is hidden without it. Logging destinations are a **Black plan** feature — otherwise the tab explains they are not in your plan.

## Supported destinations

In the UI you can select:

| Type | Status in the product |
| --- | --- |
| **Datadog** | Fully supported — events are delivered |
| **Splunk HEC** | Listed as **coming soon** — config can be saved, but forwarding is not available yet |
| **Microsoft Sentinel** | Listed as **coming soon** — same limitation |

Use **Datadog** for production forwarding today.

## Add a Datadog destination

1. Open **Settings → Logging**.
2. Choose **Add destination**.
3. Set **Type** to **Datadog**.
4. Enter a **Name** (for example `Acme Datadog`).
5. Choose the **Datadog site**:
   - US1 (`datadoghq.com`)
   - US3 (`us3.datadoghq.com`)
   - US5 (`us5.datadoghq.com`)
   - EU (`datadoghq.eu`)
   - AP1 (`ap1.datadoghq.com`)
6. Paste the Datadog **API key**. It is encrypted at rest and cannot be viewed after save (on edit, leave blank to keep the current key).
7. Optionally add **Tags** as a comma-separated list (for example `team:platform, env:prod`). Elaichi sends them via Datadog’s `ddtags` field.
8. Under **Forwarded events**, tick what to send:
   - **Tool calls** — MCP tool executions, including duration and status
   - **Authentication** — changes to members, roles, invites, domains, and API tokens
   - **Administration** — other organization settings changes  
   Leaving all three checked forwards everything (including future event types).
9. Choose **Create**.

Type cannot be changed after create. Edit name, site, tags, event filters, or rotate the API key later.

## Activate, test, and delete

| Control | Effect |
| --- | --- |
| **Active** switch | Pause or resume forwarding without deleting the destination |
| **Test** | Sends a test event; success/failure and HTTP status are recorded as last test |
| **Edit** | Update configuration |
| **Delete** | Stops forwarding immediately and permanently deletes the stored secret |

**You'll know it worked when:** **Test** reports delivered, and real events appear in Datadog shortly after activity in Elaichi.

## Good to know

- Delivery is asynchronous; a short delay after an action is normal.
- Empty event selection means nothing is forwarded for that destination.
- Splunk HEC and Sentinel show a warning that forwarding is not available yet — prefer Datadog until those ship.

## Related

- [Roles and permissions](/guides/members/roles)
- [Manage billing](/guides/settings/billing)
- [Set connector and tool restrictions](/guides/governance/set-restrictions)