Create an Observe datastream and token

Observe receives data on a per-account endpoint and authenticates with a datastream token. Collect both values before you configure the collector.

Find your customer ID

Your customer ID is the 12-digit number in the portal URL:

https://123456789012.observeinc.com

The ingest hostname adds collect. to that same number:

https://123456789012.collect.observeinc.com

The collect. hostname is required. Observe uses it to route and load balance ingest traffic.

Create a datastream and token

Perform the following steps:

In the left navigation rail, select Data & integrations > Datastreams.

This opens the Datastreams page, which lists existing datastreams with their status, health, and ingest volume.

Select [ Create Datastream ].

Enter a Name that identifies the data, for example futurex-hsm-syslog. A Description is optional.

Set the retention period, then select [ Create ]. The default retention is thirteen months, and you can change it later.

Select the new datastream’s name to open it.

Select Create > Token, enter a Name such as otel-collector, then select [ Continue ].

Copy the token and store it securely, tick the confirmation checkbox, then select [ Continue ].

Observe displays the token value only once. You cannot retrieve it after you close the confirmation dialog. Existing tokens remain listed under the datastream, but only their metadata is visible, never the secret.

Select [ Close ].

The token contains a colon that separates the token identifier from the token secret:

ds1EXAMPLEidentifier:EXAMPLEsecretvalue

Datastream tokens are for ingest only. They cannot read data or call the Observe REST API, which requires a separate API token. That limited scope makes a datastream token the correct credential for a collector.

Confirm the endpoint

The OTLP endpoint path is /v2/otel. Signal-specific suffixes are appended by the exporter, so logs arrive at /v2/otel/v1/logs.

Observe’s documentation shows both /v1/otel and /v2/otel for this endpoint. Both paths accept OTLP log payloads and return HTTP 200. Use /v2/otel, which matches the current examples. Omitting the signal suffix returns HTTP 404.

Verify credentials and the path before installing anything. Substitute your own values:

export OBSERVE_CUSTOMER=123456789012
export OBSERVE_TOKEN='ds1EXAMPLEidentifier:EXAMPLEsecretvalue'

curl -sS -X POST \
  "https://${OBSERVE_CUSTOMER}.collect.observeinc.com/v2/otel/v1/logs" \
  -H "Authorization: Bearer ${OBSERVE_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"resourceLogs":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"futurex-hsm-test"}}]},"scopeLogs":[{"logRecords":[{"body":{"stringValue":"endpoint check"},"severityText":"INFO"}]}]}]}'

A successful call returns HTTP 200. Then search the datastream for endpoint check to confirm the record landed. Interpret failures as follows:

Response	Cause
`HTTP 200`	Endpoint and token are correct.
`HTTP 404`	Wrong path. Confirm the `/v1/logs` suffix is present.
`HTTP 401`	Token is missing, malformed, or disabled. Confirm the `Authorization: Bearer` header.

Store the token safely

Do not place the token in the collector configuration file. Keep it in a file that only the collector’s service account can read, and pass it as an environment variable:

install -m 600 /dev/null /etc/observe/token.env
printf 'OBSERVE_TOKEN=%s\n' "$OBSERVE_TOKEN" > /etc/observe/token.env

To rotate a token later, create the replacement first, switch the collector to it, confirm data still flows, then disable and delete the old token.

​Find your customer ID

​Create a datastream and token

​Confirm the endpoint

​Store the token safely

Find your customer ID

Create a datastream and token

Confirm the endpoint

Store the token safely