Browser logs
Embed
<a href="https://forumulate.com/p/watchtower/docs/browser-logs"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/ba312398-3dff-4057-a411-49761157db31/social-card.svg?v=3e7ae33eec8b" alt="Browser logs" width="600" height="315"></a>The browser SDK's log() sends OTLP log records with the publishable key, to the edge's POST /v1/logs (forwarded to the gateway; set WT_EDGE_OTLP_URL on the edge) or to otlpEndpoint when you set it. If nothing can deliver them, the SDK warns once on the console.
A publishable key is readable by anyone who opens your page, so anyone can write these records. Treat them as untrusted input.
What identifies them
Field | Value |
|---|---|
resource |
|
record |
|
resource | always |
A sender cannot remove or change these. Other resource attributes are dropped, except service.version and deployment.environment.name, so a browser cannot claim a pod, host or backend service.
Alert rules: log rules (logs, log_measure and their ratios) that name no service leave browser records out, so a public key cannot move them. To alert on browser logs, name the browser:<name> service or filter on log.source or telemetry.origin. LogQL and SQL rules see whatever their query selects; select on service_name there.
Limits
Per key: 100 records a second and 1 GiB a day (429 past either). Per request: 256 KiB, 10 resources and 500 records (413 past these). Per record: 32 attributes, 128-byte keys, 2048-byte values and a 4096-byte body (longer ones are cut, others dropped). Attributes must be scalar. wt.* is removed. Only /v1/logs takes a publishable key; the push receivers (HEC, Loki and others) refuse it.
Turning them off
Project settings, Privacy, "Accept browser logs". The gateway answers 403 within 30 seconds and the SDK stops sending at its next config refresh.