Live application logs in the browser, durable NDJSON files on the data volume, and optional syslog forwarding to your SIEM.
What it is
Every server log line in Talon Studio goes through one logger. Secret-shaped values are redacted first — sensitive key=value pairs, bearer tokens, JWTs and credentials inside connection URLs — and the line is then written to the container's standard output, kept in an in-memory buffer of the latest 500 lines, appended to a durable log file, and, if configured, forwarded over syslog.
Settings → Logging (/settings/logs, admin only) has the syslog forwarder at the top and the live log viewer below it:
Filter by level and free text, and switch between All logs and AI Logs.
The capture-level selector sets the minimum level the server records, without a restart. It lasts until the next restart, which goes back to LOG_LEVEL.
Include persisted logs from disk reads up to the last 2,000 lines from the log files, so history survives restarts. On boot the last 500 lines are reloaded into the live view anyway.
Export logs downloads the lines on screen as a text file. Clear all logs empties the live view only; the files on disk are untouched.
Configuration
Set by environment variable:
LOG_LEVEL
Minimum severity recorded — debug · info · warn · error (default info).
LOG_FORMAT
How lines are written to standard output: text for humans (default) or json, one object per line, for log aggregators. The files are NDJSON either way.
LOG_DIR
Directory for the log files. The container sets it to /data/logs, on the data volume; outside the container it defaults to data/logs under the working directory.
LOG_RETENTION_DAYS
Days of log files to keep before they're pruned (default 14). Distinct from AUDIT_LOG_RETENTION_DAYS, which governs the audit trail.
LOG_MAX_FILE_MB
Size at which the day's file is rotated aside (default 50).
Files are named talon-YYYY-MM-DD.ndjson (UTC dates), one JSON object per line.
Tip
If a log collector reads the container's output, set LOG_FORMAT=json so each line parses as JSON. Keep /data on durable storage so the log files survive container restarts and upgrades.
Forwarding to a SIEM
The Log forwarding (Syslog) panel ships every recorded line to a SIEM or collector as RFC 5424. It is configured in the app, not by environment variable, and mirrored to Org/logging/logging.yaml in the org config repo.
Collector host · Port
Where to send. Both are required to turn forwarding on.
Protocol
UDP (514), TCP (514) or TLS (6514). TCP and TLS frame each message with its length (octet counting).
Facility
local0–local7 (16–23).
Verify collector certificate
TLS only, on by default. Turn it off only for a self-signed collector you trust.
CA certificate (PEM)
TLS only, optional. Stored encrypted and never written to the config repo.
Send test message confirms the collector receives a line; the panel shows whether the forwarder is connected.
TCP and TLS reconnect with exponential backoff — starting at 1 second and doubling to a 30-second cap — and queue up to 1,000 lines, dropping the oldest, while the collector is unreachable. Forwarding never blocks a request.
Changes to forwarding are recorded in the audit log.
Settings → Logging
The syslog forwarder panel — collector host and port, protocol (UDP 514 / TCP 514 / TLS 6514), facility, and Send test message to confirm the collector receives RFC 5424 lines.