> ## Documentation Index
> Fetch the complete documentation index at: https://docs.steadwing.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scalyr (DataSet)

> Steadwing connects to your Scalyr (DataSet by SentinelOne) instance to query logs, metrics, and analytical data during incidents, automatically identifying errors, affected services, and error rate trends.

## What does the Scalyr integration do?

The Scalyr integration lets Steadwing automatically search your logs for errors, identify affected servers and services, analyze error rate trends, and run complex correlations when an incident triggers. Steadwing queries your Scalyr (DataSet by SentinelOne) logs, metrics, and analytical data so you get root cause analysis without manual log investigation.

## Why Use Scalyr with Steadwing?

<CardGroup cols={2}>
  <Card title="Log Search" icon="search">
    Search for error logs, exceptions, and warnings around the incident time window
  </Card>

  <Card title="Impact Analysis" icon="server">
    Identify affected servers, services, and log sources using facet queries
  </Card>

  <Card title="Trend Analysis" icon="chart-line">
    Track error rates and latency over time to pinpoint when degradation began
  </Card>

  <Card title="Correlation" icon="chart-network">
    Run PowerQuery analytical queries to group errors by service, status code, or any dimension
  </Card>
</CardGroup>

## How do I connect Scalyr to Steadwing?

### Step 1: Get Your API Key

1. Log in to your Scalyr instance
2. Navigate to **Settings** → **API Keys** (or visit `https://<your-instance>/keys`)
3. Find or create a **Read Logs** token
4. Copy the token

<Warning>
  Use a Read Logs token (not Write). Steadwing only needs read access to query your logs during incident analysis.
</Warning>

### Step 2: Connect Scalyr in Steadwing

1. Navigate to [Steadwing Settings](https://app.steadwing.com/settings)
2. Find the **Scalyr (DataSet)** integration card
3. Click to expand the collapsible form
4. Enter your configuration:
   * **Scalyr API Key** — your Read Logs API token
   * **Scalyr URL** — your Scalyr instance URL:
     * US region: `https://app.scalyr.com`
     * EU region: `https://eu.scalyr.com`
     * Self-hosted/on-prem: your custom URL (e.g., `https://scalyr.yourcompany.com`)
5. Toggle the switch to **Enable** the integration

The integration connects immediately — no OAuth redirect required.

## What data does Steadwing pull from Scalyr?

### Data Collection

Steadwing queries Scalyr for:

* **Error Logs** - Errors, exceptions, and warnings around the incident timeframe
* **Server & Service Impact** - Affected `$serverHost` values, services, and log sources via facet queries
* **Error Trends** - Error rates and latency over time to identify degradation onset
* **Analytical Queries** - PowerQuery (SQL-like) queries to group and correlate errors by service, status code, or other dimensions

## What permissions does the Scalyr integration need?

### Required Permissions

The Scalyr API key must have:

* **Read Logs** permission to query log data

### Limitations

* Scalyr applies a shared query budget of 30,000ms of server processing time, replenished at 36,000ms/hour
* This budget is shared across all API and CLI queries for your account
* If rate limits are encountered during RCA, the agent will note partial results in its analysis

## FAQs

<AccordionGroup>
  <Accordion title="What Scalyr data does Steadwing access?">
    Steadwing reads log data using Scalyr's query and PowerQuery APIs. It does NOT write, modify, or delete any data in your Scalyr account.
  </Accordion>

  <Accordion title="Which Scalyr regions are supported?">
    US (`app.scalyr.com`), EU (`eu.scalyr.com`), and self-hosted/on-prem instances are all supported.
  </Accordion>

  <Accordion title="What if I hit rate limits during RCA?">
    Scalyr's query budget is shared across all API consumers. If limits are reached, Steadwing will note partial results in the RCA report. Check if other tools are consuming the budget.
  </Accordion>

  <Accordion title="Why am I getting empty results?">
    Verify your API key has Read Logs permission and the Scalyr URL matches your region.
  </Accordion>

  <Accordion title="What if the connection fails?">
    Verify the Scalyr URL is correct and reachable from your network. Ensure both the API key and URL fields are filled in.
  </Accordion>
</AccordionGroup>

Need additional help? Please reach out to us at [hello@steadwing.com](mailto:hello@steadwing.com)