Incident log drain

The incident log drain allows you to send detailed audit logs of various events related to your monitors, heartbeats, and incidents to an external logging service via webhooks. Each event is formatted as a JSON payload, providing comprehensive information about what happened, when, and to which resource.

We send each event as a POST request with the Content-Type: application/json; charset=utf-8 header and any request headers you set on the drain. A request times out after 25 seconds, and we retry a failed request up to 3 times.

Each payload includes common fields:

Field	Type	Description
`dt`	String	ISO 8601 formatted timestamp of when the event occurred.
`event`	String	The type of event, such as `monitor.created` or `incident.started`.
`message`	String	A human-readable message describing the event.
`organization_id`	Integer	The Better Stack ID of the organization the event originated from.
`team_id`	Integer	The Better Stack ID of the team the event originated from.

Monitor events

Events related to your uptime monitors.

`monitor.created`

Triggered when a monitor is created.

Example Payload: Monitor Created

Copied!

{
  "dt": "2026-05-13T10:05:00.000Z",
  "event": "monitor.created",
  "message": "Monitor \"My Website\" created",
  "organization_id": 123,
  "team_id": 456,
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}

Field	Type	Description
`monitor_id`	Integer	The ID of the monitor.
`monitor_url`	String	The URL being monitored.
`monitor_name`	String	The name of the monitor.
`monitor_type`	String	The type of monitor, such as `status`, `keyword`, or `ping`.

`monitor.down`

Triggered when a monitor goes down.

Example Payload: Monitor Down

Copied!

{
  "dt": "2026-05-13T10:15:00.000Z",
  "event": "monitor.down",
  "message": "Monitor \"My Website\" is down: Connection refused",
  "organization_id": 123,
  "team_id": 456,
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status",
  "cause": "Connection refused",
  "regions": ["us", "eu"]
}

Field	Type	Description
`monitor_id`	Integer	The ID of the monitor.
`monitor_url`	String	The URL being monitored.
`monitor_name`	String	The name of the monitor.
`monitor_type`	String	The type of monitor, such as `status`, `keyword`, or `ping`.
`cause`	String	The cause of the downtime.
`regions`	Array	The regions the monitor is checked from: `us`, `eu`, `as`, or `au`. `null` when the monitor uses the default regions.

`monitor.paused`

Triggered when a monitor is paused.

Example Payload: Monitor Paused

Copied!

{
  "dt": "2026-05-13T10:20:00.000Z",
  "event": "monitor.paused",
  "message": "Monitor \"My Website\" paused",
  "organization_id": 123,
  "team_id": 456,
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}

Field	Type	Description
`monitor_id`	Integer	The ID of the monitor.
`monitor_url`	String	The URL being monitored.
`monitor_name`	String	The name of the monitor.
`monitor_type`	String	The type of monitor, such as `status`, `keyword`, or `ping`.

`monitor.removed`

Triggered when a monitor is deleted.

Example Payload: Monitor Removed

Copied!

{
  "dt": "2026-05-13T10:10:00.000Z",
  "event": "monitor.removed",
  "message": "Monitor \"My Website\" removed",
  "organization_id": 123,
  "team_id": 456,
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}

Field	Type	Description
`monitor_id`	Integer	The ID of the monitor.
`monitor_url`	String	The URL being monitored.
`monitor_name`	String	The name of the monitor.
`monitor_type`	String	The type of monitor, such as `status`, `keyword`, or `ping`.

`monitor.unpaused`

Triggered when a monitor is unpaused.

Example Payload: Monitor Unpaused

Copied!

{
  "dt": "2026-05-13T10:25:00.000Z",
  "event": "monitor.unpaused",
  "message": "Monitor \"My Website\" unpaused",
  "organization_id": 123,
  "team_id": 456,
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}

Field	Type	Description
`monitor_id`	Integer	The ID of the monitor.
`monitor_url`	String	The URL being monitored.
`monitor_name`	String	The name of the monitor.
`monitor_type`	String	The type of monitor, such as `status`, `keyword`, or `ping`.

`monitor.up`

Triggered when a monitor without a recovery period comes back up.

Example Payload: Monitor Up

Copied!

{
  "dt": "2026-05-13T10:35:00.000Z",
  "event": "monitor.up",
  "message": "Monitor \"My Website\" is up",
  "organization_id": 123,
  "team_id": 456,
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}

Field	Type	Description
`monitor_id`	Integer	The ID of the monitor.
`monitor_url`	String	The URL being monitored.
`monitor_name`	String	The name of the monitor.
`monitor_type`	String	The type of monitor, such as `status`, `keyword`, or `ping`.

`monitor.updated`

Triggered when the URL, name, or type of a monitor changes.

Example Payload: Monitor Updated

Copied!

{
  "dt": "2026-05-13T10:40:00.000Z",
  "event": "monitor.updated",
  "message": "Monitor \"My Website\" updated",
  "organization_id": 123,
  "team_id": 456,
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}

Field	Type	Description
`monitor_id`	Integer	The ID of the monitor.
`monitor_url`	String	The URL being monitored.
`monitor_name`	String	The name of the monitor.
`monitor_type`	String	The type of monitor, such as `status`, `keyword`, or `ping`.

`monitor.validating`

Triggered when a monitor with a recovery period comes back up and starts verifying its recovery.

Example Payload: Monitor Validating

Copied!

{
  "dt": "2026-05-13T10:30:00.000Z",
  "event": "monitor.validating",
  "message": "Monitor \"My Website\" is validating recovery",
  "organization_id": 123,
  "team_id": 456,
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}

Field	Type	Description
`monitor_id`	Integer	The ID of the monitor.
`monitor_url`	String	The URL being monitored.
`monitor_name`	String	The name of the monitor.
`monitor_type`	String	The type of monitor, such as `status`, `keyword`, or `ping`.

Heartbeat events

Events related to your heartbeats.

`heartbeat.created`

Triggered when a heartbeat is created.

Example Payload: Heartbeat Created

Copied!

{
  "dt": "2026-05-13T11:05:00.000Z",
  "event": "heartbeat.created",
  "message": "Heartbeat \"Daily Backup\" created",
  "organization_id": 123,
  "team_id": 456,
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}

Field	Type	Description
`heartbeat_id`	Integer	The ID of the heartbeat.
`heartbeat_name`	String	The name of the heartbeat.

`heartbeat.down`

Triggered when a heartbeat goes down because it was missed.

Example Payload: Heartbeat Down

Copied!

{
  "dt": "2026-05-13T11:15:00.000Z",
  "event": "heartbeat.down",
  "message": "Heartbeat \"Daily Backup\" is down",
  "organization_id": 123,
  "team_id": 456,
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}

Field	Type	Description
`heartbeat_id`	Integer	The ID of the heartbeat.
`heartbeat_name`	String	The name of the heartbeat.

`heartbeat.paused`

Triggered when a heartbeat is paused.

Example Payload: Heartbeat Paused

Copied!

{
  "dt": "2026-05-13T11:20:00.000Z",
  "event": "heartbeat.paused",
  "message": "Heartbeat \"Daily Backup\" paused",
  "organization_id": 123,
  "team_id": 456,
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}

Field	Type	Description
`heartbeat_id`	Integer	The ID of the heartbeat.
`heartbeat_name`	String	The name of the heartbeat.

`heartbeat.removed`

Triggered when a heartbeat is deleted.

Example Payload: Heartbeat Removed

Copied!

{
  "dt": "2026-05-13T11:10:00.000Z",
  "event": "heartbeat.removed",
  "message": "Heartbeat \"Daily Backup\" removed",
  "organization_id": 123,
  "team_id": 456,
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}

Field	Type	Description
`heartbeat_id`	Integer	The ID of the heartbeat.
`heartbeat_name`	String	The name of the heartbeat.

`heartbeat.unpaused`

Triggered when a heartbeat is unpaused.

Example Payload: Heartbeat Unpaused

Copied!

{
  "dt": "2026-05-13T11:25:00.000Z",
  "event": "heartbeat.unpaused",
  "message": "Heartbeat \"Daily Backup\" unpaused",
  "organization_id": 123,
  "team_id": 456,
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}

Field	Type	Description
`heartbeat_id`	Integer	The ID of the heartbeat.
`heartbeat_name`	String	The name of the heartbeat.

`heartbeat.up`

Triggered when a heartbeat comes back up.

Example Payload: Heartbeat Up

Copied!

{
  "dt": "2026-05-13T11:30:00.000Z",
  "event": "heartbeat.up",
  "message": "Heartbeat \"Daily Backup\" is up",
  "organization_id": 123,
  "team_id": 456,
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}

Field	Type	Description
`heartbeat_id`	Integer	The ID of the heartbeat.
`heartbeat_name`	String	The name of the heartbeat.

`heartbeat.updated`

Triggered when a heartbeat is renamed.

Example Payload: Heartbeat Updated

Copied!

{
  "dt": "2026-05-13T11:35:00.000Z",
  "event": "heartbeat.updated",
  "message": "Heartbeat \"Daily Backup\" updated",
  "organization_id": 123,
  "team_id": 456,
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}

Field	Type	Description
`heartbeat_id`	Integer	The ID of the heartbeat.
`heartbeat_name`	String	The name of the heartbeat.

Incident events

Events related to incidents.

Every incident event includes the resource causing the incident. resource_type is one of monitor, heartbeat, webhook_integration, email_integration, incoming_webhook, amazon_sns_integration, call_routing, or logs_chart. resource_type, resource_id, and resource_name are null for incidents without a resource, such as manually created incidents.

`incident.acknowledged`

Triggered when an incident is acknowledged.

Example Payload: Incident Acknowledged

Copied!

{
  "dt": "2026-05-13T12:00:00.000Z",
  "event": "incident.acknowledged",
  "message": "Incident \"My Website is Down\" acknowledged by user@example.com",
  "organization_id": 123,
  "team_id": 456,
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "user_email": "user@example.com",
  "user_name": "John Doe",
  "integration_name": null,
  "integration_type": null,
  "time_to_acknowledge": 180
}

Field	Type	Description
`incident_id`	Integer	The ID of the incident.
`incident_name`	String	The name of the incident.
`resource_type`	String	The type of resource causing the incident, such as `monitor` or `heartbeat`.
`resource_id`	Integer	The ID of the resource causing the incident.
`resource_name`	String	The name of the resource causing the incident.
`user_email`	String	The e-mail of the user who acknowledged the incident, if applicable.
`user_name`	String	The name of the user who acknowledged the incident, if applicable.
`integration_name`	String	The name of the integration that acknowledged the incident, if applicable.
`integration_type`	String	The type of integration that acknowledged the incident, if applicable.
`time_to_acknowledge`	Integer	Seconds from the start of the incident to its acknowledgement.

`incident.escalated`

Triggered when an incident is escalated.

Example Payload: Incident Escalated

Copied!

{
  "dt": "2026-05-13T12:10:00.000Z",
  "event": "incident.escalated",
  "message": "Incident \"My Website is Down\" escalated to John Doe and Operations Team",
  "organization_id": 123,
  "team_id": 456,
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "escalation_targets": [
    {
      "type": "user",
      "id": 123,
      "name": "John Doe"
    },
    {
      "type": "team",
      "id": 456,
      "name": "Operations Team"
    }
  ]
}

Field	Type	Description
`incident_id`	Integer	The ID of the incident.
`incident_name`	String	The name of the incident.
`resource_type`	String	The type of resource causing the incident.
`resource_id`	Integer	The ID of the resource causing the incident.
`resource_name`	String	The name of the resource causing the incident.
`escalation_targets`	Array	An array of objects, each describing an escalation target. Each object has a `type` of `user`, `team`, `schedule`, `policy`, or `organisation`, plus `id` and `name`.

`incident.grouped`

Triggered when an incident is grouped.

Example Payload: Incident Grouped

Copied!

{
  "dt": "2026-05-13T12:15:00.000Z",
  "event": "incident.grouped",
  "message": "Incident \"My Website is Down\" grouped into incident group 999",
  "organization_id": 123,
  "team_id": 456,
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "incident_group_id": 999
}

Field	Type	Description
`incident_id`	Integer	The ID of the incident.
`incident_name`	String	The name of the incident.
`resource_type`	String	The type of resource causing the incident.
`resource_id`	Integer	The ID of the resource causing the incident.
`resource_name`	String	The name of the resource causing the incident.
`incident_group_id`	Integer	The ID of the incident group the incident was added to.

`incident.removed`

Triggered when an incident is deleted.

Example Payload: Incident Removed

Copied!

{
  "dt": "2026-05-13T12:05:00.000Z",
  "event": "incident.removed",
  "message": "Incident \"My Website is Down\" removed",
  "organization_id": 123,
  "team_id": 456,
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website"
}

Field	Type	Description
`incident_id`	Integer	The ID of the incident.
`incident_name`	String	The name of the incident.
`resource_type`	String	The type of resource causing the incident.
`resource_id`	Integer	The ID of the resource causing the incident.
`resource_name`	String	The name of the resource causing the incident.

`incident.reopened`

Triggered when an incident is reopened.

Example Payload: Incident Reopened

Copied!

{
  "dt": "2026-05-13T12:20:00.000Z",
  "event": "incident.reopened",
  "message": "Incident \"My Website is Down\" reopened by user@example.com",
  "organization_id": 123,
  "team_id": 456,
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "user_email": "user@example.com",
  "user_name": "John Doe",
  "integration_name": null,
  "integration_type": null
}

Field	Type	Description
`incident_id`	Integer	The ID of the incident.
`incident_name`	String	The name of the incident.
`resource_type`	String	The type of resource causing the incident.
`resource_id`	Integer	The ID of the resource causing the incident.
`resource_name`	String	The name of the resource causing the incident.
`user_email`	String	The e-mail of the user who reopened the incident, if applicable.
`user_name`	String	The name of the user who reopened the incident, if applicable.
`integration_name`	String	The name of the integration that reopened the incident, if applicable.
`integration_type`	String	The type of integration that reopened the incident, if applicable.

`incident.resolved`

Triggered when an incident is resolved.

Example Payload: Incident Resolved

Copied!

{
  "dt": "2026-05-13T12:25:00.000Z",
  "event": "incident.resolved",
  "message": "Incident \"My Website is Down\" resolved by user@example.com",
  "organization_id": 123,
  "team_id": 456,
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "user_email": "user@example.com",
  "user_name": "John Doe",
  "integration_name": null,
  "integration_type": null,
  "time_to_resolve": 1500
}

Field	Type	Description
`incident_id`	Integer	The ID of the incident.
`incident_name`	String	The name of the incident.
`resource_type`	String	The type of resource causing the incident.
`resource_id`	Integer	The ID of the resource causing the incident.
`resource_name`	String	The name of the resource causing the incident.
`user_email`	String	The e-mail of the user who resolved the incident, if applicable.
`user_name`	String	The name of the user who resolved the incident, if applicable.
`integration_name`	String	The name of the integration that resolved the incident, if applicable.
`integration_type`	String	The type of integration that resolved the incident, if applicable.
`time_to_resolve`	Integer	Seconds from the start of the incident to its resolution.

`incident.started`

Triggered when an incident starts.

Example Payload: Incident Started

Copied!

{
  "dt": "2026-05-13T12:30:00.000Z",
  "event": "incident.started",
  "message": "Incident \"My Website is Down\" started: Connection refused",
  "organization_id": 123,
  "team_id": 456,
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "incident_cause": "Connection refused",
  "regions": ["us", "eu"],
  "escalation_policy_id": 111
}

Field	Type	Description
`incident_id`	Integer	The ID of the incident.
`incident_name`	String	The name of the incident.
`resource_type`	String	The type of resource causing the incident.
`resource_id`	Integer	The ID of the resource causing the incident.
`resource_name`	String	The name of the resource causing the incident.
`incident_cause`	String	The cause of the incident.
`regions`	Array	The regions the monitor is checked from: `us`, `eu`, `as`, or `au`. `null` for incidents not caused by a monitor, or when the monitor uses the default regions.
`escalation_policy_id`	Integer	The ID of the escalation policy triggered by the incident, if applicable.

Test event

Triggered when you click Send a test log in the drain settings.

Example Payload: Test

Copied!

{
  "dt": "2026-05-13T13:00:00.000Z",
  "event": "test",
  "message": "Test event",
  "organization_id": 123,
  "team_id": 456,
  "integration_name": "Production log drain"
}

Field	Type	Description
`integration_name`	String	The name of the incident log drain.

Get usage per product

Explore documentation

Incident log drain