Ship logs to New Relic

Use this guide to stream your Audit Logs to New Relic via the Log API.

Step 1: Create a New Relic license key

In New Relic, go to Administration → API keys and create an Ingest - License key for Firezone to use. Also note which region your New Relic account reports to: US, EU, Japan, or FedRAMP.

Step 2: Create the Log Sink in Firezone

In the admin portal, go to SettingsLog Sinks, click Add, and select New Relic. Configure the sink:

FieldDescription
NameA name to identify this log sink.
RegionUS, EU, Japan, or FedRAMP. Determines which Log API endpoint is used.
License KeyA New Relic license key, also called an ingest key, to authenticate with.

Then choose which Log streams to deliver, all four of which are enabled by default, and optionally check Deliver existing logs to backfill logs recorded before the sink was created.

Deliver existing logs can only be selected when you create the sink. It can't be turned on later for an existing sink. Also, New Relic drops payloads with timestamps older than 48 hours, so backfilled events older than that will not appear in New Relic.

Click Create. Deliveries begin within about a minute.

Delivery format

Firezone POSTs to /log/v1 on your region's Log API endpoint: log-api.newrelic.com, log-api.eu.newrelic.com, log-api.jp.nr-data.net, or gov-log-api.newrelic.com. The body uses the Log API's detailed format: [{"logs": [...]}]. Each log's attributes carry logtype: "firezone" and the stream name, so you can filter with logtype = 'firezone' in the Logs UI. The full event is under the firezone attribute, and timestamp is epoch milliseconds.

[
  {
    "logs": [
      {
        "timestamp": 1784021191114,
        "message": "firezone change c0654d20aa1b4a0000000002",
        "attributes": {
          "logtype": "firezone",
          "stream": "change",
          "firezone": {
            "type": "change",
            "log_id": "c0654d20aa1b4a0000000002",
            "timestamp": "2026-07-14T09:26:31.114213Z",
            "object": "policies",
            "operation": "update",
            "before": {
              "id": "0a83588e-…",
              "description": "Engineering → GitLab"
            },
            "after": {
              "id": "0a83588e-…",
              "description": "Engineering → GitLab (MFA required)"
            },
            "subject": {
              "actor_id": "e2f6a9c4-…",
              "actor_name": "Jamie Admin",
              "actor_email": "jamie@company.com",
              "actor_type": "account_admin_user",
              "auth_provider_id": "9d0c2f4e-…",
              "ip": "203.0.113.44",
              "ip_region": "US",
              "ip_city": "San Francisco",
              "ip_lat": 37.7749,
              "ip_lon": -122.4194,
              "user_agent": "Mozilla/5.0 …"
            }
          }
        }
      }
    ]
  }
]

How Firezone responds to HTTP status codes

ResponseBehavior
202The batch is accepted and delivery advances.
429, 5xxRetried every minute. If failures persist for 24 hours, the sink is disabled and account admins are emailed.
413The batch is split in half and retried to isolate an oversized event.
Other 4xxTreated as a configuration error, for example 403 for an invalid license key: the sink is disabled immediately.

Duplicates and redelivery

Firezone guarantees at-least-once delivery, retrying any batch that isn't acknowledged rather than risk losing data, so New Relic can occasionally receive the same event twice. When it does, deduplicate on firezone.log_id: flow start and end events are already suffixed with -s and -e, which makes the log_id a unique key across all streams.

Also keep New Relic's own 48-hour timestamp cutoff in mind: events delivered more than 48 hours after they occurred, for example a backfill of old history or a sink recovering from a long outage, are silently dropped by New Relic.

Recovering a failed sink

A sink showing Warning is retrying automatically, so unless the failures continue there's nothing you need to do. A sink showing Error has stopped delivering and needs attention: fix the cause , commonly a revoked license key or the wrong region, then open the sink, click Edit, and click Save to re-enable it. Delivery picks up right where it left off, from the last acknowledged entry, and Deliver Now triggers a delivery immediately if you don't want to wait for the next cycle.

Deleting the sink deletes its delivery state along with it, so re-creating it starts fresh: the new sink delivers logs recorded from its creation onward, plus a full backfill if Deliver existing logs is selected, subject to the 48-hour cutoff, which re-sends events New Relic may already have.

Need help? See all support options.

Found a problem with this page? Open an issue
Last updated: July 20, 2026