Skip to main content

​
What does the Scalyr integration do?

The Scalyr integration lets Steadwing automatically search your logs for errors, identify affected servers and services, analyze error rate trends, and run complex correlations when an incident triggers. Steadwing queries your Scalyr (DataSet by SentinelOne) logs, metrics, and analytical data so you get root cause analysis without manual log investigation.

​
Why Use Scalyr with Steadwing?

Log Search

Search for error logs, exceptions, and warnings around the incident time window

Impact Analysis

Identify affected servers, services, and log sources using facet queries

Trend Analysis

Track error rates and latency over time to pinpoint when degradation began

Correlation

Run PowerQuery analytical queries to group errors by service, status code, or any dimension

​
How do I connect Scalyr to Steadwing?

​
Step 1: Get Your API Key

  1. Log in to your Scalyr instance
  2. Navigate to Settings → API Keys (or visit https://<your-instance>/keys)
  3. Find or create a Read Logs token
  4. Copy the token
Use a Read Logs token (not Write). Steadwing only needs read access to query your logs during incident analysis.

​
Step 2: Connect Scalyr in Steadwing

  1. Navigate to Steadwing Settings
  2. Find the Scalyr (DataSet) integration card
  3. Click to expand the collapsible form
  4. Enter your configuration:
    • Scalyr API Key — your Read Logs API token
    • Scalyr URL — your Scalyr instance URL:
      • US region: https://app.scalyr.com
      • EU region: https://eu.scalyr.com
      • Self-hosted/on-prem: your custom URL (e.g., https://scalyr.yourcompany.com)
  5. Toggle the switch to Enable the integration
The integration connects immediately — no OAuth redirect required.

​
What data does Steadwing pull from Scalyr?

​
Data Collection

Steadwing queries Scalyr for:
  • Error Logs - Errors, exceptions, and warnings around the incident timeframe
  • Server & Service Impact - Affected $serverHost values, services, and log sources via facet queries
  • Error Trends - Error rates and latency over time to identify degradation onset
  • Analytical Queries - PowerQuery (SQL-like) queries to group and correlate errors by service, status code, or other dimensions

​
What permissions does the Scalyr integration need?

​
Required Permissions

The Scalyr API key must have:
  • Read Logs permission to query log data

​
Limitations

  • Scalyr applies a shared query budget of 30,000ms of server processing time, replenished at 36,000ms/hour
  • This budget is shared across all API and CLI queries for your account
  • If rate limits are encountered during RCA, the agent will note partial results in its analysis

​
FAQs

Steadwing reads log data using Scalyr’s query and PowerQuery APIs. It does NOT write, modify, or delete any data in your Scalyr account.
US (app.scalyr.com), EU (eu.scalyr.com), and self-hosted/on-prem instances are all supported.
Scalyr’s query budget is shared across all API consumers. If limits are reached, Steadwing will note partial results in the RCA report. Check if other tools are consuming the budget.
Verify your API key has Read Logs permission and the Scalyr URL matches your region.
Verify the Scalyr URL is correct and reachable from your network. Ensure both the API key and URL fields are filled in.
Need additional help? Please reach out to us at hello@steadwing.com