Stream logs to a SIEM

Workforce has three logs you can send to a SIEM. Tool calls and API requests are pulled: your platform polls the log endpoints. LLM calls are pushed: AI Gateway sends each model request to a destination you configure.

Tool call and API request logs

Two cursor-paginated endpoints let your SIEM pull logs on a schedule. Full schemas are in the API reference.

How the endpoints work

Both endpoints behave identically:

A poll loop is two shapes of the same request. The first starts from the beginning of the retention window:

curl -s "https://ah-api.merge.dev/api/v1/logs/tool-calls/?page_size=1000&created_after=2026-05-13T00:00:00Z" \
  -H "Authorization: Bearer $PRODUCTION_KEY"

It answers with results, a next_cursor, and has_more. Every later poll passes that cursor back:

curl -s "https://ah-api.merge.dev/api/v1/logs/tool-calls/?page_size=1000&cursor=eyJ0…" \
  -H "Authorization: Bearer $PRODUCTION_KEY"

Repeat until has_more is false, persist the last next_cursor, and resume from it on the next run.

Native pull vs. forwarder

Platforms fall into two camps:

• Native pull: the platform has a built-in REST/API poller that follows cursor pagination for you, so configuring it is the whole job. Microsoft Sentinel, Elastic, Cribl Stream, and Sumo Logic are in this camp.
• Forwarder: the platform is push-only (it expects you to send logs to its intake), so you run a small scheduled job that walks the cursor loop above and posts batches to the platform. Datadog and Splunk are most reliably integrated this way.

Either way, the source side is identical: page through the endpoint with cursor, persist next_cursor, stop on has_more: false.

Platform setup

import requests
cursor = state.load()
ah = {"Authorization": f"Bearer {AH_PRODUCTION_KEY}"}
dd_url = "https://http-intake.logs.datadoghq.com/api/v2/logs"
dd = {"Content-Type": "application/json", "DD-API-KEY": DD_API_KEY}
while True:
    params = {"page_size": 1000}
    if cursor:
        params["cursor"] = cursor
    else:
        params["created_after"] = "2026-05-13T00:00:00Z"
    body = requests.get(
        "https://ah-api.merge.dev/api/v1/logs/tool-calls/", headers=ah, params=params, timeout=30,
    ).json()
    batch = [
        {"ddsource": "agent-handler", "service": "ah-tool-calls",
         "ddtags": "env:prod", "message": rec}
        for rec in body["results"]
    ]
    if batch:
        requests.post(dd_url, headers=dd, json=batch, timeout=30).raise_for_status()
    cursor = body["next_cursor"]
    state.save(cursor)
    if not body["has_more"]:
        break

LLM calls from AI Gateway

LLM calls have no pull endpoint. Gateway’s Telemetry export pushes each model request as an OpenTelemetry span over OTLP/HTTP, so there is no polling or cursor to manage. Export covers only requests made after you create a destination.

Each span carries the model, provider, token counts, and cost. See the full attribute list.

Pick a destination

Set up destinations in the Gateway console under Settings → Telemetry export. The Workforce dashboard doesn’t have this setting.

Send to any other SIEM

Point a custom endpoint at your platform’s OTLP/HTTP receiver if it has one. If it doesn’t, run an OpenTelemetry Collector in between and use the matching contrib exporter, such as splunk_hec or elasticsearch. This Collector forwards Gateway spans to Splunk HEC:

extensions:
  bearertokenauth:
    token: ${env:GATEWAY_EXPORT_TOKEN}
receivers:
  otlp:
    protocols:
      http:
        endpoint: 0.0.0.0:4318
        auth:
          authenticator: bearertokenauth
exporters:
  splunk_hec:
    endpoint: https://splunk.acme.com:8088/services/collector
    token: ${env:SPLUNK_HEC_TOKEN}
    index: merge_gateway
    sourcetype: "merge:gateway:llm_calls"
service:
  extensions: [bearertokenauth]
  pipelines:
    traces:
      receivers: [otlp]
      exporters: [splunk_hec]

In the Gateway console, choose Custom OTLP endpoint, enter the Collector’s base URL (https://otel.acme.com), and use GATEWAY_EXPORT_TOKEN as the bearer token.

Gotchas

• Enter the base URL only. Gateway appends /v1/traces, which matches the Collector’s default path.
• The endpoint must be public HTTPS with no redirects. Gateway rejects private, loopback, link-local, and cloud metadata addresses.
• Auth is Authorization: Bearer <token> only. Put a Collector in front of platforms that need another scheme.
• Don’t sample a destination you use as a security record. Sampling drops some successful requests.

Prompts and completions

Privacy mode is on for new destinations and strips prompt and completion content. Turn it off only if your SIEM is approved to hold prompts. It’s separate from payload logging, so a SIEM can receive prompts that Merge doesn’t store.

Delivery and failures

Gateway retries transient failures and suspends a destination after repeated failures. Export never slows model calls, but it fails silently, so alert in your SIEM when LLM call spans stop arriving.

Next

See what the tool call rows you are forwarding contain in Tool call logs.