Manage log streams

A log source can produce one or more log streams — the individual flows of data Sazabi ingests. This guide covers where to manage them, how to pause and resume a stream without deleting it, and how to remove one. By the end you will have confirmed a stream change took effect. Each action takes under a minute.

Streams and sources

A log source is a connected platform or endpoint. A log stream is a specific flow of data from that source — for example, one Vercel drain, one CloudWatch subscription, or one endpoint key. A source with several destinations has several streams. You manage streams under Settings > Log streams (the page is titled Log source providers).

Enable and disable a stream

Pausing a stream stops its ingestion without deleting it — a reversible switch, distinct from deleting.

1. Go to Settings > Log streams and open the source.
2. Find the stream you want to pause and choose Pause ingestion from its actions menu.
3. Ingestion for that stream stops. Choose Resume ingestion to start it again; the source keeps its configuration either way.

For push streams, pausing flips the stream's dedicated ingest key, so a paused stream rejects incoming data until you resume it.

An agent can do the same with the CLI. Find the source with sazabi log-sources list, list its streams with sazabi log-streams list --log-source-id <id>, then pause or resume a stream by ID with sazabi log-streams disable <stream-id> and sazabi log-streams enable <stream-id>. To pause or resume every stream on a source at once, use sazabi log-sources disable <id> and sazabi log-sources enable <id>. See CLI reference for install and auth.

Delete a stream

Deleting a stream removes it and stops its ingestion for good.

1. Go to Settings > Log streams and open the source.
2. Select the stream and delete it.
3. Sazabi soft-deletes the stream, deactivates its ingest key, and tears down any provisioned forwarding. Historical logs already stored are unaffected and remain searchable until they age out of retention.

An agent can delete a stream by ID with sazabi log-streams delete <stream-id>, or delete the whole source (and every stream under it) with sazabi log-sources delete <log-source-id>.

Verify

Confirm a stream change actually took effect.

1. Disable a stream that is currently receiving data — toggle it off on Settings > Log streams, or run sazabi log-streams disable <stream-id>.
2. Watch ingestion volume for a recent time range: open the Intake page in the dashboard, or run sazabi logs volume --last 1h --group-by service.
3. Within a few minutes, that stream's contribution to the ingestion volume should fall to zero while other streams continue. Re-enable it (sazabi log-streams enable <stream-id>) and volume should resume.

If volume does not change, confirm you disabled the right stream and that the source was actually sending data before you paused it.

Further reading