New Relic Log Delivery

RTLD may automatically deliver compressed log data to your New Relic account by submitting HTTPS POST requests to it. Each request represents a compressed JSON or CSV document that uniquely identifies a set of log data and describes one or more log entries.

Key information:

The format for log data delivered to New Relic is JSON Array. This log format does not provide information that uniquely identifies a set of log data. As a result, there is no way to check for gaps in sequence numbers when attempting to identify missing log data.
You must define an event type when setting up a log delivery profile. Query delivered log data by constructing a NRQL that selects data using this event type label (e.g., SELECT * FROM Event Type).
RTLD authorizes requests to New Relic through an Inserts insight API key. Due to security best practices, we recommend using a dedicated API key for RTLD requests.
The set of available log fields varies by RTLD module: RTLD CDN | RTLD Rate Limiting | RTLD Bot | RTLD Cloud Functions
All RTLD modules, except for the RTLD WAF module, support delivery to the New Relic destination.

To set up New Relic log delivery

Optional. Register an Inserts insight API key that is dedicated for RTLD log delivery.

View New Relic documentation on how to register an Inserts insight API key.
Upon completing the above step, you should create a log delivery profile for New Relic.

To set up a log delivery profile

From the Real-Time Log Delivery page, click + New Log Delivery Profile and then select the desired type of log field.
1. Open the desired property.
  1. Select either your private space or a team space.
  2. Click on the desired property.
2. From the left pane, click on the desired environment.
3. From the left pane, click Realtime Log Delivery.
4. Click + New Log Delivery Profile and then select either CDN, WAF, Rate Limiting, Bot, or Cloud Functions.
From the Profile Name option, assign a name to this log delivery profile.
From the Log Delivery Method option, select New Relic.
Define how RTLD will communicate with New Relic.
1. Set the Account ID option to your New Relic account ID.
2. Set the Event Type option to a label that identifies log data delivered to New Relic as a result of this profile. Specify a label that solely consists of alphanumeric characters, underscores, and colons.
3. Set the Insert Key option to an Inserts insight API key.
From the Log Format option, select whether to format log data using our standard JSON format, as a JSON array, as JSON lines, or as a CSV (RTLD CDN only).

Learn more about these formats: RTLD CDN | RTLD WAF | RTLD Rate Limiting | RTLD Bot | RTLD Cloud Functions
From the Downsample the Logs option, determine whether to reduce the amount of log data that will be delivered. For example, you may choose to only deliver 1% of your log data.
- All Log Data: Verify that the Downsample the Logs option is cleared.
- Downsampled Log Data: Downsample logs to 0.1%, 1%, 25%, 50%, or 75% of total log data by marking the Downsample the Logs option and then selecting the desired rate from the Downsampling Rate option.
  
  Use this capability to reduce the amount of data that needs to be processed or stored within your web server(s).
  
  RTLD CDN Only: Downsampling log data also reduces usage charges for this service.
Determine whether log data will be filtered.
By default, all log fields are enabled on a new log delivery profile. From within the Fields section, clear each field for which log data should not be reported.
- Log fields are categorized. You may add or remove individual fields by expanding a category and then marking or clearing specific log fields. Alternatively, add or remove all of the log fields associated with a category by marking or clearing the desired category.
- RTLD CDN Only: You may also log request headers, response headers, and cookies.
- View log field definitions: RTLD CDN | RTLD WAF | RTLD Rate Limiting | RTLD Bot | RTLD Cloud Functions
Click Create Log Delivery Profile.