# Supabase log drains to Belvador over OTLP

> Send Postgres, Auth, Storage, Edge Functions, Realtime and API gateway logs to Belvador with an OpenTelemetry drain, with privacy and volume notes.

Supabase can forward its platform logs — Postgres, Auth, Storage, Edge Functions, Realtime and the API gateway — to an OTLP endpoint with a log drain. Log drains are a paid add-on on Pro, Team and Enterprise projects, billed per drain plus usage; check Supabase's pricing before adding one.

> **Not tested yet:** this setup follows the vendor's documentation; Belvador has not run it end to end.

## Add the drain

1. In Belvador, create an [ingest key](https://belvador.dev/en/docs/otel/quickstart#1-create-an-ingest-key) with **Logs** only and no environment restriction (Supabase sends no environment).
2. In Supabase, open **Project Settings → Log Drains**, add a drain and choose **OpenTelemetry**:

| Field | Value |
|---|---|
| Endpoint | `https://ingest.belvador.dev/otlp/<project-id>/v1/logs` |
| Protocol | `http/protobuf` |
| Gzip | On |
| Header | `Authorization: Bearer <ingest key>` |

Supabase wants the full logs URL, not the base endpoint.

## What you get

Supabase's logs appear in **Logs**, searchable by text and severity. They are platform logs, not traces: they carry no trace id from your app, so they do not appear on a trace's **Logs** tab or under an issue's **Logs around this error**. Logs that your own code writes in Edge Functions are among them.

Platform logs can contain query text, emails in Auth events and request paths. Belvador's node [filters](https://belvador.dev/en/docs/otel/privacy) known secret patterns and masks the name part of email addresses and public IP addresses before storing, but other query text inside a log line is stored as written — review a day of them before you keep the drain on.

Mind the volume: Postgres and API gateway logs grow with traffic and count against the monthly logs quota ([Sampling and cost](https://belvador.dev/en/docs/otel/sampling-and-cost)).

## Do not use the generic HTTP drain

Supabase's **Custom endpoint** drain sends a JSON array, not OTLP, and Belvador's endpoint refuses it. Use the OpenTelemetry type above.

## Status

This follows Supabase's documentation; Belvador has not run a drain end to end yet, so it is marked untested. After setup, open **Logs**, pick the last 15 minutes and look for entries from the Supabase service names.