Skip to main content
Log Drains send project output outside Pxxl for longer retention, compliance, search, or analysis. The documentation puts this feature under Storage. In the product, configure it from Project > Settings > Log Drains. An account can have up to three log drains. A drain is account-owned and can be enabled for one or more projects.

​
Connection

Pxxl supports two destination kinds: For S3-compatible storage, enter: Pxxl stores credentials in protected credential storage. The database keeps only a reference to them and the non-secret destination settings. For an HTTPS destination, enter the public URL and configure the token or headers the endpoint expects. Pxxl sends Content-Type: application/x-ndjson, Content-Encoding: gzip, and a Pxxl user agent. A configured token is sent as a Bearer token.

​
S3-compatible flow

Pxxl batches events and writes objects with a time-partitioned key:
If no prefix is supplied, Pxxl uses a private drain prefix based on the drain ID. The object contains one JSON event per line after decompression. The exact event fields vary by source and can include build output, deployment events, runtime output, and HTTP activity.

​
Create a drain

1

Prepare the destination

Create a dedicated bucket or prefix. Make sure the endpoint is public HTTPS and the key can write to the selected location.
2

Open Log Drains

From the project, open Settings > Log Drains and create a destination.
3

Enter the S3 settings

Add the endpoint, bucket, region, prefix, access key, and secret key. Select the log sources you want to export.
4

Test the destination

Use the destination test. Pxxl emits a test event and attempts an immediate delivery.
5

Enable the project subscription

Attach the drain to the project, then produce fresh output and confirm a new object appears in the bucket.

​
AWS CLI preflight

Run these checks with a restricted test credential before entering the values in Pxxl:
The write and delete commands are optional and change the bucket. Run them only in a test prefix. The Pxxl test action is the authoritative check because it validates the complete drain configuration and sends a real test event. For Cloudflare R2, set PXXL_ENDPOINT to https://ACCOUNT_ID.r2.cloudflarestorage.com and set AWS_REGION=auto. For MinIO, use its public HTTPS endpoint and configured region.

​
Least-privilege AWS policy

For a log-only prefix, the access key can be limited to bucket inspection and object writes. Add read or delete permissions only if your retention workflow needs them.

​
Monitoring and failures

The drain test and project settings show whether the destination is active. Pxxl records delivery attempts in its outbox and retries failed deliveries with backoff. A delivery is marked failed after repeated attempts. A drain can become disabled after an extended failure period, so check the destination’s last error and update its credentials or endpoint before enabling it again. Use the destination’s bucket lifecycle rules to expire or archive old objects. Pxxl does not use an external bucket as a replacement for the project’s Live Logs view.

​
HTTPS destinations

An HTTPS drain receives a compressed NDJSON request. The endpoint must use a public HTTPS hostname that does not resolve to a private, loopback, metadata, multicast, or reserved network. Pxxl follows only a small number of redirects and validates each destination again. Your receiver should:
  1. authenticate the Bearer token or configured header;
  2. accept the gzip encoded body;
  3. return a 2xx response after safely storing the payload;
  4. process events asynchronously if the receiver needs more time.
For application assets and signed object delivery, use the CDN API instead. CDN storage and log-drain destinations have different jobs.