---
title: "Connect Logfire"
description: "Send Logfire alerts to Firefight through a Raw Data webhook channel, with the source's secret held in its address."
canonical: https://firefight.app/docs/alerts/logfire
---

# Connect Logfire

Firefight has a dedicated alert source for Logfire alerts. Logfire's webhook channel sends no headers, so the source's secret is part of its URL, and an alert resolves in Firefight when its query stops returning rows.

## Set up the Firefight side

Go to **Settings → Alert Sources**, click **Add source**, give it a name like "Logfire production", and pick the **Logfire** provider. When you create it, Firefight opens the source's setup. It shows the ingest URL masked, a **Copy URL** button that copies it whole, and the same steps as this page.

:::caution
The URL holds the source's secret, so anyone with it can send alerts to this source. Paste it into Logfire and nowhere else. Only people who can change alert sources see it whole or copy it.
:::

## Set up the Logfire side

1. In Logfire, open the alert, and under **Send notifications to**, choose **Add channel**.
2. Name the channel, choose **Raw Data** as its type and paste the URL.
3. Send a test alert, which Logfire needs to succeed before it creates the channel. Then create the channel and tick it for each alert that should reach Firefight.
4. Set **Fire when** to the query starts or stops having results, so the alert resolves in Firefight when the query stops returning rows.

The test arrives in Firefight as a real alert, so a routing rule that creates incidents opens one for it.

Requests to the source's address with a wrong secret are rejected with `401`, and the source's row in **Settings → Alert Sources** shows the rejection.

## Regenerate the address

If the URL leaks, open the source in **Settings → Alert Sources** and click **Regenerate address** in its setup. The old address stops working at once, so paste the new one into Logfire straight away, or its alerts are refused.

## What Firefight reads

Each alert gets these fields, which you can match in your [routing rules](https://firefight.app/docs/alerts/routing-rules.md).

| Field | Value |
|---|---|
| `title` | The alert's name |
| `description` | The alert's description, how many rows the query returned, and Logfire's errors when it could not run the query |
| `service` | The Logfire project |
| `url` | The alert run in Logfire |

The alert's title in Slack and on the dashboard links to its page in Logfire.

## Firing and resolving

An alert fires when its query returns rows, and resolves when Logfire says the query stopped returning them. A query Logfire could not run fires too, with Logfire's errors in the description, since an alert that cannot run watches nothing. Every notification for the same Logfire alert lands on the same Firefight alert.

See [Grouping & deduplication](https://firefight.app/docs/alerts/grouping-and-deduplication.md) for how repeat firings collapse into one alert.