Connect Logfire

Firefight has a dedicated alert source for Logfire alerts. Logfire’s webhook channel sends no headers, so the source’s secret is part of its URL, and an alert resolves in Firefight when its query stops returning rows.

Set up the Firefight side

Go to Settings → Alert Sources, click Add source, give it a name like “Logfire production”, and pick the Logfire provider. When you create it, Firefight opens the source’s setup. It shows the ingest URL masked, a Copy URL button that copies it whole, and the same steps as this page.

Caution

The URL holds the source’s secret, so anyone with it can send alerts to this source. Paste it into Logfire and nowhere else. Only people who can change alert sources see it whole or copy it.

Set up the Logfire side

1. In Logfire, open the alert, and under Send notifications to, choose Add channel.
2. Name the channel, choose Raw Data as its type and paste the URL.
3. Send a test alert, which Logfire needs to succeed before it creates the channel. Then create the channel and tick it for each alert that should reach Firefight.
4. Set Fire when to the query starts or stops having results, so the alert resolves in Firefight when the query stops returning rows.

The test arrives in Firefight as a real alert, so a routing rule that creates incidents opens one for it.

Requests to the source’s address with a wrong secret are rejected with 401, and the source’s row in Settings → Alert Sources shows the rejection.

Regenerate the address

If the URL leaks, open the source in Settings → Alert Sources and click Regenerate address in its setup. The old address stops working at once, so paste the new one into Logfire straight away, or its alerts are refused.

What Firefight reads

Each alert gets these fields, which you can match in your routing rules.

Field	Value
title	The alert’s name
description	The alert’s description, how many rows the query returned, and Logfire’s errors when it could not run the query
service	The Logfire project
url	The alert run in Logfire

The alert’s title in Slack and on the dashboard links to its page in Logfire.

Firing and resolving

An alert fires when its query returns rows, and resolves when Logfire says the query stopped returning them. A query Logfire could not run fires too, with Logfire’s errors in the description, since an alert that cannot run watches nothing. Every notification for the same Logfire alert lands on the same Firefight alert.

See Grouping & deduplication for how repeat firings collapse into one alert.