tailscale_set_log_stream_config
Set log streaming configuration for Tailscale audit or network logs to destinations like Splunk, Datadog, Elasticsearch, S3, Axiom, and others.
Instructions
Set the log streaming configuration for a specific log type. Configures where logs are sent (e.g. Axiom, Datadog, Splunk, Elasticsearch, S3).
Per-destination required fields:
splunk / elastic / panther / cribl / datadog / axiom: url + token (user optional)
s3: s3Bucket + s3Region + s3AuthenticationType, plus either (s3AccessKeyId + s3SecretAccessKey) for 'accesskey' auth or s3RoleArn for 'rolearn' auth. Call tailscale_create_aws_external_id first when using 'rolearn'.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Destination URL (required for non-s3 destinations) | |
| user | No | Username for the destination (if required) | |
| token | No | Authentication token or API key for the destination. SENSITIVE: passed straight to Tailscale and not echoed back, but MCP clients may log the input value you supply. | |
| logType | Yes | The log type: 'configuration' for audit logs, 'network' for network flow logs | |
| s3Bucket | No | (s3 only) S3 bucket name. Required when destinationType is 's3'. | |
| s3Region | No | (s3 only) AWS region of the S3 bucket. Required when destinationType is 's3'. | |
| s3RoleArn | No | (s3 only) IAM role ARN that Tailscale will assume. Required when s3AuthenticationType is 'rolearn'. | |
| s3KeyPrefix | No | (s3 only) Optional prefix prepended to the auto-generated S3 object key. | |
| s3AccessKeyId | No | (s3 only) AWS access key id. Required when s3AuthenticationType is 'accesskey'. | |
| destinationType | Yes | The log streaming destination type | |
| compressionFormat | No | Compression algorithm for log uploads. Defaults to 'none'. | |
| s3SecretAccessKey | No | (s3 only) AWS secret access key. Required when s3AuthenticationType is 'accesskey'. SENSITIVE: see the token field's note about MCP client logging. | |
| uploadPeriodMinutes | No | Minutes to wait between uploads (1-1440). Optional. | |
| s3AuthenticationType | No | (s3 only) Authentication mode. Required when destinationType is 's3'. Tailscale recommends 'rolearn'. |