{"slug":"log-streaming","title":"Log streaming","tags":["tailscale","logging"],"agent_summary":"Last validated: Feb 2, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Log streaming\r\n\r\nLast validated: Feb 2, 2026\r\n\r\nConfiguration audit log streamingis available for [the Personal and Enterprise plans](https://tailscale.com/pricing).\r\n\r\nNetwork flow log streamingis available for [the Enterprise plan](https://tailscale.com/pricing).\r\n\r\nLog streaming lets you collect and send [configuration audit logs](https://tailscale.com/docs/features/logging/audit-logging) or [network flow logs](https://tailscale.com/docs/features/logging/network-flow-logs) about your Tailscale network (known as a tailnet) into various systems for collection and analysis.\r\n\r\nYou can use `User-Agent: TailscaleLogStreamPublisher` to identify Tailscale traffic.\r\n\r\n## [Supported integrations](https://tailscale.com/docs/features/logging/log-streaming\\#supported-integrations)\r\n\r\nTailscale supports different ways of integrating log streaming.\r\n\r\n### [SIEM integrations](https://tailscale.com/docs/features/logging/log-streaming\\#siem-integrations)\r\n\r\nYou can stream logs into a Security information and event management ( [SIEM](https://tailscale.com/learn/security-information-and-event-management)) system to help detect and respond to security threats, set up alerting and monitoring rules, and the like.\r\n\r\nWe support log streaming integrations for the following SIEM systems:\r\n\r\n- [Axiom](https://axiom.co/)\r\n- [Cribl](https://cribl.io/)\r\n- [Datadog](https://www.datadoghq.com/)\r\n- [Elasticsearch Logstash](https://www.elastic.co/logstash), through a [data stream](https://www.elastic.co/guide/en/elasticsearch/reference/current/data-streams.html)\r\n- [Panther](https://panther.com/)\r\n- [Splunk](https://www.splunk.com/), through an [HTTP Event Collector](https://dev.splunk.com/enterprise/docs/devtoolshttpeventcollector)\r\n- [Additional SIEM systems](https://tailscale.com/docs/features/logging/log-streaming#additional-siem-systems)\r\n\r\n### [Amazon S3 and S3-compatible services](https://tailscale.com/docs/features/logging/log-streaming\\#amazon-s3-and-s3-compatible-services)\r\n\r\nYou can stream your logs to Amazon S3 and S3-compatible services for various cloud storage providers.\r\n\r\nWe support log streaming integrations for sending logs to the following S3 bucket types:\r\n\r\n- [Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html)\r\n- S3-compatible services, including:\r\n - [Storj](https://www.storj.io/)\r\n - [Wasabi](https://wasabi.com/)\r\n\r\n### [Google Cloud services](https://tailscale.com/docs/features/logging/log-streaming\\#google-cloud-services)\r\n\r\n- [Google Cloud Storage](https://cloud.google.com/storage) (GCS)\r\n\r\n### [Other integrations types](https://tailscale.com/docs/features/logging/log-streaming\\#other-integrations-types)\r\n\r\nAdditional integrations that you can use for log streaming include:\r\n\r\n- [Private endpoints](https://tailscale.com/docs/features/logging/log-streaming#private-endpoints)\r\n- [Vector](https://vector.dev/)\r\n\r\n## [Prerequisites](https://tailscale.com/docs/features/logging/log-streaming\\#prerequisites)\r\n\r\n- You need an endpoint and credentials for either your SIEM integration or S3 cloud storage provider. Consult your vendor's documentation for how to get an endpoint and API credentials.\r\n- You need to be an [Owner, Admin, Network admin, or IT admin](https://tailscale.com/docs/reference/user-roles) to add, edit, and delete a streaming destination.\r\n\r\n## [Configuration log streaming](https://tailscale.com/docs/features/logging/log-streaming\\#configuration-log-streaming)\r\n\r\nConfiguration audit log streamingis available for [the Personal and Enterprise plans](https://tailscale.com/pricing).\r\n\r\n### [Add configuration log streaming](https://tailscale.com/docs/features/logging/log-streaming\\#add-configuration-log-streaming)\r\n\r\n[SIEM integrations](https://tailscale.com/docs/features/logging/log-streaming?tab=siem+integrations) [Amazon S3](https://tailscale.com/docs/features/logging/log-streaming?tab=amazon+s3) [S3-compatible](https://tailscale.com/docs/features/logging/log-streaming?tab=s3-compatible) [Google Cloud Storage](https://tailscale.com/docs/features/logging/log-streaming?tab=google+cloud+storage)\r\n\r\n1. Open the [Configuration logs](https://login.tailscale.com/admin/logs) page of the admin console.\r\n2. Select **Start streaming**.\r\n3. In the **Start streaming configuration logs** dialog:\r\n1. Select a SIEM destination.\r\n2. For **URL**, enter your SIEM endpoint. The endpoint URL must use the HTTPS protocol, and there\r\n is no restriction on which port is used.\r\n Splunk's HTTP Endpoint Connectors require an endpoint ending with `/services/collector/event`.\r\n Elasticsearch's data streams require an endpoint ending with `/_bulk?pretty`.\r\n3. If your SIEM system requires a value for **Username**, enter the SIEM username.\r\n4. For **Token**, enter the SIEM API token.\r\n4. Select **Start streaming**.\r\n\r\n![The 'Start streaming configuration logs' dialog. Listing several available destinations.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fstream-configuration-logs.a0e59194.png&w=750&q=75)\r\n\r\nCheck your SIEM system to verify you are successfully streaming from your tailnet.\r\n\r\nDepending on network conditions, there may be a delay before you can see the log streaming appear in your third-party tools.\r\n\r\n### [Edit a configuration log streaming destination](https://tailscale.com/docs/features/logging/log-streaming\\#edit-a-configuration-log-streaming-destination)\r\n\r\nYou can change the information for passing your logs to your preferred streaming destination.\r\n\r\n1. Open the [Configuration logs](https://login.tailscale.com/admin/logs) page of the admin console.\r\n2. For the system that you want to update, select the **Action** dropdown, then select **Edit**.\r\n3. Update the values as needed.\r\n4. Select **Save changes**.\r\n\r\nIf you are editing a log streaming destination for an Amazon S3 bucket, you can update the **Role ARN** field (the Amazon resource name) if the resource name already belongs to the specified AWS account. If the role does not belong to the AWS account, you must delete the log streaming destination in the admin console and create a new one.\r\n\r\n### [Delete a configuration log streaming destination](https://tailscale.com/docs/features/logging/log-streaming\\#delete-a-configuration-log-streaming-destination)\r\n\r\n1. Open the [Configuration logs](https://login.tailscale.com/admin/logs) page of the admin console.\r\n2. For the integration that you want to delete, select the **Action** dropdown, then select **Delete**.\r\n3. In the confirmation dialog, select **Delete**.\r\n\r\n## [Network log streaming](https://tailscale.com/docs/features/logging/log-streaming\\#network-log-streaming)\r\n\r\nNetwork flow log streamingis available for [the Enterprise plan](https://tailscale.com/pricing).\r\n\r\n### [Add a network log streaming destination](https://tailscale.com/docs/features/logging/log-streaming\\#add-a-network-log-streaming-destination)\r\n\r\n[SIEM integrations](https://tailscale.com/docs/features/logging/log-streaming?tab=siem+integrations) [Amazon S3](https://tailscale.com/docs/features/logging/log-streaming?tab=amazon+s3) [S3-compatible](https://tailscale.com/docs/features/logging/log-streaming?tab=s3-compatible) [Google Cloud Storage](https://tailscale.com/docs/features/logging/log-streaming?tab=google+cloud+storage)\r\n\r\n1. If you haven't already, [enable Network flow logs](https://tailscale.com/docs/features/logging/network-flow-logs#enable-network-flow-logs) for your tailnet.\r\n2. Open the [Network flow logs](https://login.tailscale.com/admin/logs/network) page of the admin console.\r\n3. Select **Start streaming**.\r\n4. In the **Start streaming network logs** dialog:\r\n1. Select a SIEM destination.\r\n2. For **URL**, enter your SIEM endpoint. The endpoint URL must use the HTTPS protocol, and there\r\n is no restriction on which port is used.\r\n Splunk's HTTP Endpoint Connectors require an endpoint ending with `/services/collector/event`.\r\n Elasticsearch's data stream endpoints end with `/_bulk?pretty`.\r\n3. If your SIEM system requires a value for **Username**, enter the SIEM username.\r\n4. For **Token**, enter the SIEM API token.\r\n5. Select **Start streaming**.\r\n\r\n![The 'Start streaming network logs' dialog. Listing several available destinations.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fstream-network-logs.76861e07.png&w=750&q=75)\r\n\r\nCheck your SIEM system to verify you are successfully streaming from your tailnet.\r\n\r\nDepending on network conditions, there may be a delay before you can see the log streaming appear in your third-party tools.\r\n\r\n### [Edit a network log streaming destination](https://tailscale.com/docs/features/logging/log-streaming\\#edit-a-network-log-streaming-destination)\r\n\r\nYou can change the information for passing your logs to your preferred streaming destination.\r\n\r\n1. Open the [Network flow logs](https://login.tailscale.com/admin/logs/network) page of the admin console.\r\n2. For the system that you want to update, select the **Action** dropdown, then select **Edit**.\r\n3. Update the values as needed.\r\n4. Select **Save changes**.\r\n\r\nIf you are editing a log streaming destination for an Amazon S3 bucket, you can update the **Role ARN** field (the Amazon resource name) if the resource name already belongs to the specified AWS account. If the role does not belong to the AWS account, you must delete the log streaming destination in the admin console and create a new one.\r\n\r\n### [Delete a network log streaming destination](https://tailscale.com/docs/features/logging/log-streaming\\#delete-a-network-log-streaming-destination)\r\n\r\n1. Open the [Network flow logs](https://login.tailscale.com/admin/logs/network) page of the admin console.\r\n2. For the integration that you want to delete, select the **Action** dropdown, then select **Delete**.\r\n3. In the confirmation dialog, select **Delete**.\r\n\r\n## [Private endpoints](https://tailscale.com/docs/features/logging/log-streaming\\#private-endpoints)\r\n\r\nLog streaming can publish logs to a host that is\r\ndirectly reachable over the public internet,\r\nin which case the endpoint must use HTTPS for security.\r\nAlternatively, log streaming can publish logs to a private host\r\nthat is not directly reachable over the public internet\r\nby using Tailscale for connectivity.\r\nPlain HTTP may be used since the underlying transport is\r\nsecured by Tailscale using WireGuard.\r\n\r\nUse of log streaming to a private host is detected automatically\r\nbased on the host specified in the endpoint URL.\r\n\r\n![An example of the URL used for private endpoints.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fprivate-endpoint-url.b93a54fd.png&w=828&q=75)\r\n\r\nThe host must reference a node within your tailnet and\r\ncan be any of the following:\r\n\r\n- The name of a Tailscale node (for example, `splunk`).\r\n- The [fully-qualified domain name](https://tailscale.com/docs/features/magicdns#fully-qualified-domain-names-vs-machine-names) of a Tailscale node (for example, `splunk.yak-bebop.ts.net`).\r\n- The IPv6 address of a Tailscale node (for example, `fd7a:115c:a1e0:ab12:0123:4567:89ab:cdef`).\r\n\r\nOnly IPv6 addresses are supported for log streaming. IPv4 addresses are not supported for log streaming because Tailscale uses CGNAT for IPv4 addresses assigned to nodes within a single tailnet. This can present an issue because IPv4 addresses can be reused across a tailnet. IPv6 addresses are not reused, and hostnames will always route to the correct node.\r\n\r\nLog streaming to a private endpoint operates by [sharing](https://tailscale.com/docs/features/sharing) your node\r\ninto a Tailscale-managed tailnet, where a Tailscale-managed node will\r\npublish logs directly to your node. This requires both sharing your node\r\nout to Tailscale's `logstream` tailnet, and modifying your [tailnet policy file](https://tailscale.com/docs/features/access-control/acls) to support incoming traffic to your node from the `logstream@tailscale` user.\r\n\r\nWhen adding or updating an endpoint that points to a private host,\r\nthe control plane may need to share your node and/or update the tailnet policy file on your behalf. If additional configuration changes are needed, a follow-up dialog box\r\nwill ask you for permission to perform the necessary actions.\r\nAudit log events will be generated for these operations and\r\nthe actions will be attributed to you.\r\n\r\n![The 'Grant share access to private host' confirmation dialog to share the node or update the tailnet policy file.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fprivate-endpoint-confirmation.f857e999.png&w=828&q=75)\r\n\r\nAfter adding or updating the endpoint, the node will be listed on the\r\n[Machines](https://login.tailscale.com/admin/machines) page of the admin console\r\nas having been shared out to the `logstream@tailscale` user.\r\nAlso, the tailnet policy file will be modified with a rule similar to the following:\r\n\r\n```json\r\n{\r\n // Private log streaming enables audit and network logs to be directly\r\n // uploaded to a node in your tailnet without exposing it to the public internet.\r\n // This access rule provides access for a Tailscale-managed node to upload logs\r\n // directly to the specified node.\r\n // See https://tailscale.com/docs/features/logging/log-streaming#private-endpoints\r\n \"action\": \"accept\",\r\n \"src\": [\"logstream@tailscale\"],\r\n \"dst\": [\"[nodeAddressV6]:port\"],\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\nwhere:\r\n\r\n- `nodeAddressV6` is the IPv6 address of the Tailscale node.\r\n- `port` is the service port for the log streaming system.\r\n\r\nThe IPv6 address is specified as the log stream publisher that can communicate with your node over v6 of the Internet Protocol.\r\n\r\nOnly IPv6 addresses are supported for log streaming. IPv4 addresses are not supported for log streaming because Tailscale uses CGNAT for IPv4 addresses assigned to nodes within a single tailnet. This can present an issue because IPv4 addresses can be reused across a tailnet. IPv6 addresses are not reused, and hostnames will always route to the correct node.\r\n\r\nSince log streaming to a private host may require\r\nthe ability to share nodes and the ability to update the tailnet policy file,\r\nonly the [Admin](https://tailscale.com/docs/reference/user-roles#admin) and [Network admin](https://tailscale.com/docs/reference/user-roles#network-admin) roles\r\nhave sufficient permissions to unilaterally make use of private endpoints.\r\nThe [IT admin](https://tailscale.com/docs/reference/user-roles#it-admin) has the ability to share nodes,\r\nbut lacks the ability to update the tailnet policy file.\r\nAn IT admin can still make use of private endpoints,\r\nbut requires either an Admin or Network admin to manually update\r\nthe tailnet policy file before logs can start streaming.\r\n\r\nIf your tailnet is configured to use [GitOps for management of Tailscale](https://tailscale.com/docs/gitops), you will receive\r\nan error when Tailscale attempts to update your tailnet policy file to support incoming\r\ntraffic from the `logstream@tailscale` user. To avoid this error, first use GitOps to add an\r\n[access rule](https://tailscale.com/docs/reference/syntax/policy-file#acls) that lets incoming traffic from the `logstream@tailscale` user reach the node that you use for the private endpoint, and then add your private endpoint as the log\r\nstreaming URL.\r\n\r\n## [Additional SIEM systems](https://tailscale.com/docs/features/logging/log-streaming\\#additional-siem-systems)\r\n\r\nWe strive to support many common SIEM systems used by our customers, but we cannot support all the commercial and open-source SIEM and logging tools available. Some SIEM systems have [Splunk HTTP Event Collector (Splunk HEC)](https://dev.splunk.com/enterprise/docs/devtoolshttpeventcollector) compatible endpoints such as [DataSet by SentinelOne](https://app.scalyr.com/solutions/splunk-hec). If your SIEM supports Splunk HEC, configure [configuration audit log streaming](https://tailscale.com/docs/features/logging/log-streaming#configuration-log-streaming) and [network flow log streaming](https://tailscale.com/docs/features/logging/log-streaming#network-log-streaming) per the instructions above to stream logs directly to your SIEM as if it were Splunk.\r\n\r\nIf we do not support your SIEM system, you can use [Vector](https://vector.dev/), an open-source high-performance observability data pipeline, to ingest log data from Tailscale by using Vector's Splunk HEC support and deliver it to Vector's many supported SIEM systems, called \"sinks\" in Vector's terminology. Vector supports a number of [sinks](https://vector.dev/docs/reference/configuration/sinks) such as object storage systems, messaging queuing systems, Grafana Loki, New Relic, and more.\r\n\r\n### [Vector deployment](https://tailscale.com/docs/features/logging/log-streaming\\#vector-deployment)\r\n\r\nTo use Vector with log streaming from Tailscale:\r\n\r\n1. Follow Vector's [deployment guide](https://vector.dev/docs/setup/deployment) to deploy a machine running Vector to your infrastructure.\r\n2. Configure Vector's [Splunk HTTP Event Collector (HEC) source](https://vector.dev/docs/reference/configuration/sources/splunk_hec) to allow Tailscale to send log data to Vector.\r\n3. Configure the [Vector sink](https://vector.dev/docs/reference/configuration/sinks) for your SIEM as the destination for the log streaming data.\r\n4. Configure [configuration audit log streaming](https://tailscale.com/docs/features/logging/log-streaming#configuration-log-streaming) and [network flow log streaming](https://tailscale.com/docs/features/logging/log-streaming#network-log-streaming) per the instructions above to stream logs to your Vector instance, ideally using [private endpoints](https://tailscale.com/docs/features/logging/log-streaming#private-endpoints).\r\n\r\n### [Vector example configuration](https://tailscale.com/docs/features/logging/log-streaming\\#vector-example-configuration)\r\n\r\nThe Vector configuration below receives data from the `splunk_hec` source and outputs data to the `file` sink:\r\n\r\n```yaml\r\n# /etc/vector/vector.yaml\r\n\r\nsources:\r\n splunk_hec:\r\n type: \"splunk_hec\"\r\n address: \"100.x.y.z:8088\" # Your Vector Tailscale device's IP or hostname\r\n valid_tokens:\r\n - \"YOUR TOKEN\"\r\n\r\nsinks:\r\n file_sink:\r\n type: \"file\"\r\n inputs:\r\n - \"splunk_hec\"\r\n path: \"/vector-data-dir/tailscale-%Y-%m-%d.log\"\r\n encoding:\r\n codec: \"json\"\r\n```\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Log streaming

\n

Last validated: Feb 2, 2026

\n

Configuration audit log streamingis available for the Personal and Enterprise plans.

\n

Network flow log streamingis available for the Enterprise plan.

\n

Log streaming lets you collect and send configuration audit logs or network flow logs about your Tailscale network (known as a tailnet) into various systems for collection and analysis.

\n

You can use User-Agent: TailscaleLogStreamPublisher to identify Tailscale traffic.

\n

Supported integrations

\n

Tailscale supports different ways of integrating log streaming.

\n

SIEM integrations

\n

You can stream logs into a Security information and event management ( SIEM) system to help detect and respond to security threats, set up alerting and monitoring rules, and the like.

\n

We support log streaming integrations for the following SIEM systems:

\n\n

Amazon S3 and S3-compatible services

\n

You can stream your logs to Amazon S3 and S3-compatible services for various cloud storage providers.

\n

We support log streaming integrations for sending logs to the following S3 bucket types:

\n\n

Google Cloud services

\n\n

Other integrations types

\n

Additional integrations that you can use for log streaming include:

\n\n

Prerequisites

\n\n

Configuration log streaming

\n

Configuration audit log streamingis available for the Personal and Enterprise plans.

\n

Add configuration log streaming

\n

SIEM integrations Amazon S3 S3-compatible Google Cloud Storage

\n
    \n
  1. Open the Configuration logs page of the admin console.
    2. \n
  2. Select Start streaming.
    3. \n
  3. In the Start streaming configuration logs dialog:
    4. \n
  4. Select a SIEM destination.
    5. \n
  5. For URL, enter your SIEM endpoint. The endpoint URL must use the HTTPS protocol, and there\r\nis no restriction on which port is used.\r\nSplunk's HTTP Endpoint Connectors require an endpoint ending with /services/collector/event.\r\nElasticsearch's data streams require an endpoint ending with <stream_id>/_bulk?pretty.
    6. \n
  6. If your SIEM system requires a value for Username, enter the SIEM username.
    7. \n
  7. For Token, enter the SIEM API token.
    8. \n
  8. Select Start streaming.
    9. \n
\n

\"The

\n

Check your SIEM system to verify you are successfully streaming from your tailnet.

\n

Depending on network conditions, there may be a delay before you can see the log streaming appear in your third-party tools.

\n

Edit a configuration log streaming destination

\n

You can change the information for passing your logs to your preferred streaming destination.

\n
    \n
  1. Open the Configuration logs page of the admin console.
    2. \n
  2. For the system that you want to update, select the Action dropdown, then select Edit.
    3. \n
  3. Update the values as needed.
    4. \n
  4. Select Save changes.
    5. \n
\n

If you are editing a log streaming destination for an Amazon S3 bucket, you can update the Role ARN field (the Amazon resource name) if the resource name already belongs to the specified AWS account. If the role does not belong to the AWS account, you must delete the log streaming destination in the admin console and create a new one.

\n

Delete a configuration log streaming destination

\n
    \n
  1. Open the Configuration logs page of the admin console.
    2. \n
  2. For the integration that you want to delete, select the Action dropdown, then select Delete.
    3. \n
  3. In the confirmation dialog, select Delete.
    4. \n
\n

Network log streaming

\n

Network flow log streamingis available for the Enterprise plan.

\n

Add a network log streaming destination

\n

SIEM integrations Amazon S3 S3-compatible Google Cloud Storage

\n
    \n
  1. If you haven't already, enable Network flow logs for your tailnet.
    2. \n
  2. Open the Network flow logs page of the admin console.
    3. \n
  3. Select Start streaming.
    4. \n
  4. In the Start streaming network logs dialog:
    5. \n
  5. Select a SIEM destination.
    6. \n
  6. For URL, enter your SIEM endpoint. The endpoint URL must use the HTTPS protocol, and there\r\nis no restriction on which port is used.\r\nSplunk's HTTP Endpoint Connectors require an endpoint ending with /services/collector/event.\r\nElasticsearch's data stream endpoints end with <stream_id>/_bulk?pretty.
    7. \n
  7. If your SIEM system requires a value for Username, enter the SIEM username.
    8. \n
  8. For Token, enter the SIEM API token.
    9. \n
  9. Select Start streaming.
    10. \n
\n

\"The

\n

Check your SIEM system to verify you are successfully streaming from your tailnet.

\n

Depending on network conditions, there may be a delay before you can see the log streaming appear in your third-party tools.

\n

Edit a network log streaming destination

\n

You can change the information for passing your logs to your preferred streaming destination.

\n
    \n
  1. Open the Network flow logs page of the admin console.
    2. \n
  2. For the system that you want to update, select the Action dropdown, then select Edit.
    3. \n
  3. Update the values as needed.
    4. \n
  4. Select Save changes.
    5. \n
\n

If you are editing a log streaming destination for an Amazon S3 bucket, you can update the Role ARN field (the Amazon resource name) if the resource name already belongs to the specified AWS account. If the role does not belong to the AWS account, you must delete the log streaming destination in the admin console and create a new one.

\n

Delete a network log streaming destination

\n
    \n
  1. Open the Network flow logs page of the admin console.
    2. \n
  2. For the integration that you want to delete, select the Action dropdown, then select Delete.
    3. \n
  3. In the confirmation dialog, select Delete.
    4. \n
\n

Private endpoints

\n

Log streaming can publish logs to a host that is\r\ndirectly reachable over the public internet,\r\nin which case the endpoint must use HTTPS for security.\r\nAlternatively, log streaming can publish logs to a private host\r\nthat is not directly reachable over the public internet\r\nby using Tailscale for connectivity.\r\nPlain HTTP may be used since the underlying transport is\r\nsecured by Tailscale using WireGuard.

\n

Use of log streaming to a private host is detected automatically\r\nbased on the host specified in the endpoint URL.

\n

\"An

\n

The host must reference a node within your tailnet and\r\ncan be any of the following:

\n\n

Only IPv6 addresses are supported for log streaming. IPv4 addresses are not supported for log streaming because Tailscale uses CGNAT for IPv4 addresses assigned to nodes within a single tailnet. This can present an issue because IPv4 addresses can be reused across a tailnet. IPv6 addresses are not reused, and hostnames will always route to the correct node.

\n

Log streaming to a private endpoint operates by sharing your node\r\ninto a Tailscale-managed tailnet, where a Tailscale-managed node will\r\npublish logs directly to your node. This requires both sharing your node\r\nout to Tailscale's logstream tailnet, and modifying your tailnet policy file to support incoming traffic to your node from the logstream@tailscale user.

\n

When adding or updating an endpoint that points to a private host,\r\nthe control plane may need to share your node and/or update the tailnet policy file on your behalf. If additional configuration changes are needed, a follow-up dialog box\r\nwill ask you for permission to perform the necessary actions.\r\nAudit log events will be generated for these operations and\r\nthe actions will be attributed to you.

\n

\"The

\n

After adding or updating the endpoint, the node will be listed on the\r\nMachines page of the admin console\r\nas having been shared out to the logstream@tailscale user.\r\nAlso, the tailnet policy file will be modified with a rule similar to the following:

\n
{\r\n  // Private log streaming enables audit and network logs to be directly\r\n  // uploaded to a node in your tailnet without exposing it to the public internet.\r\n  // This access rule provides access for a Tailscale-managed node to upload logs\r\n  // directly to the specified node.\r\n  // See https://tailscale.com/docs/features/logging/log-streaming#private-endpoints\r\n  \"action\": \"accept\",\r\n  \"src\":    [\"logstream@tailscale\"],\r\n  \"dst\":    [\"[nodeAddressV6]:port\"],\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

where:

\n\n

The IPv6 address is specified as the log stream publisher that can communicate with your node over v6 of the Internet Protocol.

\n

Only IPv6 addresses are supported for log streaming. IPv4 addresses are not supported for log streaming because Tailscale uses CGNAT for IPv4 addresses assigned to nodes within a single tailnet. This can present an issue because IPv4 addresses can be reused across a tailnet. IPv6 addresses are not reused, and hostnames will always route to the correct node.

\n

Since log streaming to a private host may require\r\nthe ability to share nodes and the ability to update the tailnet policy file,\r\nonly the Admin and Network admin roles\r\nhave sufficient permissions to unilaterally make use of private endpoints.\r\nThe IT admin has the ability to share nodes,\r\nbut lacks the ability to update the tailnet policy file.\r\nAn IT admin can still make use of private endpoints,\r\nbut requires either an Admin or Network admin to manually update\r\nthe tailnet policy file before logs can start streaming.

\n

If your tailnet is configured to use GitOps for management of Tailscale, you will receive\r\nan error when Tailscale attempts to update your tailnet policy file to support incoming\r\ntraffic from the logstream@tailscale user. To avoid this error, first use GitOps to add an\r\naccess rule that lets incoming traffic from the logstream@tailscale user reach the node that you use for the private endpoint, and then add your private endpoint as the log\r\nstreaming URL.

\n

Additional SIEM systems

\n

We strive to support many common SIEM systems used by our customers, but we cannot support all the commercial and open-source SIEM and logging tools available. Some SIEM systems have Splunk HTTP Event Collector (Splunk HEC) compatible endpoints such as DataSet by SentinelOne. If your SIEM supports Splunk HEC, configure configuration audit log streaming and network flow log streaming per the instructions above to stream logs directly to your SIEM as if it were Splunk.

\n

If we do not support your SIEM system, you can use Vector, an open-source high-performance observability data pipeline, to ingest log data from Tailscale by using Vector's Splunk HEC support and deliver it to Vector's many supported SIEM systems, called \"sinks\" in Vector's terminology. Vector supports a number of sinks such as object storage systems, messaging queuing systems, Grafana Loki, New Relic, and more.

\n

Vector deployment

\n

To use Vector with log streaming from Tailscale:

\n
    \n
  1. Follow Vector's deployment guide to deploy a machine running Vector to your infrastructure.
    2. \n
  2. Configure Vector's Splunk HTTP Event Collector (HEC) source to allow Tailscale to send log data to Vector.
    3. \n
  3. Configure the Vector sink for your SIEM as the destination for the log streaming data.
    4. \n
  4. Configure configuration audit log streaming and network flow log streaming per the instructions above to stream logs to your Vector instance, ideally using private endpoints.
    5. \n
\n

Vector example configuration

\n

The Vector configuration below receives data from the splunk_hec source and outputs data to the file sink:

\n
# /etc/vector/vector.yaml\r\n\r\nsources:\r\n  splunk_hec:\r\n    type: \"splunk_hec\"\r\n    address: \"100.x.y.z:8088\" # Your Vector Tailscale device's IP or hostname\r\n    valid_tokens:\r\n      - \"YOUR TOKEN\"\r\n\r\nsinks:\r\n  file_sink:\r\n    type: \"file\"\r\n    inputs:\r\n      - \"splunk_hec\"\r\n    path: \"/vector-data-dir/tailscale-%Y-%m-%d.log\"\r\n    encoding:\r\n      codec: \"json\"\n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}