Skip to content

Forward audit events

A logging destination is a place outside Elaichi, such as Datadog, where Elaichi sends this organization’s events. The events include MCP tool calls, authentication changes, and administration changes. Sign-in events that happen outside an organization are not forwarded.

Where to find it: Settings → Logging

Before you start

Requirement Details
Permission Manage logging (logging:manage) to add, change, test, or delete destinations. View logging (logging:view) lets you see the list only.
Plan Black. On other plans the tab says “Logging destinations need the Black plan” and points you to support.
Datadog account A Datadog API key and the site your account uses

Destination types

Type Status
Datadog Available. Events are delivered.
Splunk HEC Marked coming soon. You can save the settings, but Elaichi does not forward events yet.
Microsoft Sentinel Marked coming soon. You can save the settings, but Elaichi does not forward events yet.

Use Datadog today.

Add a Datadog destination

  1. Open Settings → Logging.

  2. Click Add destination.

  3. Set Type to Datadog.

  4. Enter a Name, such as Acme Datadog.

  5. Choose the Datadog site your account uses:

    • US1 (datadoghq.com)
    • US3 (us3.datadoghq.com)
    • US5 (us5.datadoghq.com)
    • EU (datadoghq.eu)
    • AP1 (ap1.datadoghq.com)

  6. Paste your Datadog API key. Elaichi stores it encrypted and cannot show it again.

  7. Optional: enter Tags separated by commas, for example team:platform, env:prod. Elaichi adds them to each event in Datadog’s ddtags field.

  8. Under Forwarded events, tick the kinds of events to send:

    • Tool calls: MCP tool executions, including duration and status.
    • Authentication: changes to members, roles, invites, domains, and API tokens.
    • Administration: other changes to organization settings.

    If you leave all three ticked, Elaichi forwards everything, including event kinds added in the future.

  9. Click Create.

You cannot change the type after you create a destination. You can change the name, site, tags, and events later. To replace the API key, enter a new one when you edit. Leave the field blank to keep the current key.

Test, pause, or delete a destination

Control What it does
Active switch Pauses or resumes forwarding. The destination and its settings stay.
Test Sends a test event. Elaichi records whether it was delivered and the HTTP status as the last test.
Edit Changes the settings.
Delete Stops forwarding right away and permanently deletes the stored API key. You cannot undo this.

After you add a destination, click Test. You will see Test event delivered, and real events appear in Datadog shortly after activity in Elaichi.

What to know

  • Delivery is asynchronous. A short delay after an action is normal.
  • If you tick no event kinds, the destination receives nothing.
  • Splunk HEC and Microsoft Sentinel show a warning that forwarding is not available yet.