External log sources

The Autter platform can ingest repository-scoped logs from Sentry, PostHog, Grafana/Loki, Datadog and generic webhooks. Configure them under Repository → Settings → Runtime → Data sources when this feature is enabled on your deployment.

How it works

External collection runs in the Autter platform. Its independent workers fetch provider records, store each occurrence under your selected repository, and start Runtime analysis. You do not need an application SDK or Runtime ingest key for this path. Keep SDK instrumentation if you also want application spans, source maps, usage or LLM telemetry. Repeated deliveries and overlapping poll/webhook records are deduplicated within a source. SDK and provider events are not guaranteed to become the same issue group.

Setup

Select the connected repository and open Runtime settings. Owners/admins can configure sources.
Choose a provider, enter its project/service and environments, and supply read credentials through the settings form. Sentry uses organization/project slugs; PostHog uses a project ID and personal read key; Grafana uses a Loki URL/query and optional Tempo credentials; Datadog uses an API key plus an application key with logs-read access.
Test access and inspect matching samples. Save the connection. Store the returned private webhook URL securely if using push delivery.
Choose collection-only, investigation, or investigation plus draft fixes. Warning analysis is separately opt-in; high/critical is the default automatic-draft threshold. The repository’s automatic-draft switch also applies.
Inspect Runtime errors for stored messages, severity, stacks/trace context and RCA. Check the actual draft PR URL when a fix completes; a queued job is not a created PR.

Polling is periodic, with a default 60-second interval plus provider delay. The new webhook route returns 202 after committing records and work. Analysis and fixes complete asynchronously. Backfilled historical records do not initiate automatic fixes. Missing stacks/source maps or insufficient code evidence produce a needs-evidence result. Recovery comes from a resolved webhook; monitor-state polling is not implemented. Project selection uses manually entered IDs/slugs. Datadog stores supplied trace context without a separate APM trace fetch; Grafana can fetch a linked Tempo trace. Disconnecting removes credentials and stops new collection while preserving retained evidence.

Generic webhook record

Send this shape to the private URL provided by your repository connection. Do not send it to /v1/browser or authenticate it with a Runtime ingest key. Replace event ID, timestamp, service/environment and diagnostics with real values.

{
  "eventId": "stable-event-id",
  "fingerprint": "checkout-missing-customer",
  "title": "Checkout could not load customer",
  "message": "Cannot read properties of undefined",
  "severity": "error",
  "service": "checkout",
  "environment": "production",
  "occurredAt": "2026-09-28T12:00:00Z",
  "stack": "TypeError: Cannot read properties of undefined\n    at checkout (src/checkout.ts:42:3)",
  "release": "deployed-commit-sha",
  "traceId": "trace-id"
}

Use {"records":[...]} for batches of up to 100. Alerts use kind: "alert", action: "fired"; recovery uses the same fingerprint/service/environment with a new event ID, later timestamp and action: "resolved". If configured, generic/Datadog webhooks also require the x-autter-signature shared-secret header; Sentry uses its integration HMAC. Do not forward secrets, cookies, request bodies or personal data unnecessarily. The platform bounds and redacts stored diagnostic fields; upstream scrubbing is still recommended. Provider credentials, private webhook URLs, Runtime server/client ingest keys and CLI personal tokens serve different purposes.

Automation and troubleshooting

The RCA and draft fixes mode also requires the repository’s automatic-fixes setting, an active connection, matching environment, sufficient severity, an actionable root cause with matching source files, and available organization budget. A running fixer rechecks policy before publishing. You review the resulting draft PR before merging it. Warnings remain visible even when warning analysis is disabled. Unknown severity does not become a high-priority issue automatically. An individual warning/error log does not necessarily open an incident.

No records: inspect the provider project, service/environment filter and last successful collection. A read with zero samples does not confirm that your filters match traffic.
Access denied: check token type and read scopes. PostHog needs a personal read key; its browser project key cannot read events.
Needs evidence: supply source-mapped frames or usable stack traces and release identity. A trace ID alone is insufficient for a code fix.
Fix deferred or skipped: inspect the severity threshold, repository switch, connection mode, resolution state and organization budget.
Disconnected source: retained records and analysis remain visible, while collection stops.

Migrate an existing organization connection

Open Organization settings → Data sources → Existing organization connections. Create and test the repository connection, switch the provider’s destination to its new private URL, confirm delivery, then disconnect the old connection. Existing history is preserved. Avoid sending to both destinations indefinitely because old and new issue identities differ. See Runtime setup skills for agent-assisted configuration and architecture for the SDK/provider storage boundaries.

Get started

Guides

Reference