Monitor Vercel with Sazabi
Last verified on Nov 8, 2026.
A Vercel deployment produces several kinds of output that never meet in one place. Builds write to a build log. Functions write to runtime logs. Requests that never reach a function, such as a redirect or a firewall denial, still leave a record. Vercel can push all of it out through drains, and each record carries the deployment, project and request it belongs to.
Sazabi is AI-native observability and security. It takes those drains as log records, so a question about one failing request can pull the function output, the edge decision and the build that shipped it.
What Sazabi reads from Vercel
Vercel's log drain sends objects with a source of build, edge, lambda, static, external, firewall or redirect. Sazabi accepts all seven. Each record has a level (info, warning, error or fatal), a deploymentId, a projectId and, for requests, a requestId and a statusCode. Request details sit under proxy: method, path, client address, region and cache result. Vercel's reference also lists traceId and spanId on records that carry trace context (Vercel: Log Drains reference).
The connected-account path adds two more kinds of data. Trace drains forward OpenTelemetry spans from serverless and edge functions, and analytics drains forward Web Analytics events for projects that have Web Analytics enabled.
Sazabi ingests OpenTelemetry metrics (Prometheus metrics through an OpenTelemetry Collector) and OTLP traces through the same intake as your logs. It stores each metric data point and each span as a log record that its agent queries alongside your logs, so there is no separate metrics store to run.
The manual path is logs only, and the log drain must deliver JSON. The agent side is separate: the Vercel CLI connection gives the Sazabi agent the vercel command in its sandbox.
Questions it answers
- Which deployment started returning errors, and what did the build log say when it shipped?
- Are the 500s coming from
lambdafunctions,edgefunctions or a rewrite to anexternalorigin? - Which firewall rule denied this client, and is it still denying legitimate traffic?
- Did a preview environment or a production environment produce this error?
- Which requests ran in
executionRegioniad1and not anywhere else?
A worked example: a function that crashed
Vercel documents a statusCode of -1 to mean no response was returned and the lambda crashed. That value is easy to miss in a status-code chart, because it is not a 5xx. Search for it directly:
sazabi logs ask "Show Vercel records where source is lambda and statusCode is -1 in the last hour, grouped by path"Here is one example record with made-up values:
{
"id": "1573817250283254651097202070",
"deploymentId": "dpl_example123",
"source": "lambda",
"level": "error",
"statusCode": -1,
"path": "/api/export",
"requestId": "643af4e3-975a-4cc7-9e7a-1eda11539d90",
"executionRegion": "iad1",
"environment": "production",
"projectName": "storefront",
"proxy": { "method": "POST", "path": "/api/export?format=csv", "clientIp": "203.0.113.24", "statusCode": -1 }
}One path, one region and one deployment point at a single function. Take the deploymentId and ask what changed in that deployment, using the build records with the same ID. If the crashes began with a deploy, roll back and then read the function output for the same requestId. If they did not, check whether a payload size or a downstream timeout is the cause.
Volume controls
Vercel lets you sample a log drain by environment and path prefix. With no rules, a log drain forwards 100% of data. You can sample static traffic at a low rate and keep lambda and firewall at full volume, so the records you debug with stay complete. Vercel truncates a message over 256 KB.
How it fits with other integrations
Vercel apps usually sit on other services. A Postgres database on Supabase or Neon answers the question the function logs raise. Edge traffic in front of a Vercel project can come from Cloudflare. Other hosting platforms are listed under cloud platforms, and the full catalog is on the integrations page. For pricing, see Sazabi pricing.
Log sources
- Vercel (native log source, cloud platforms): Connect your Vercel account so Sazabi can create and manage log, trace, and Web Analytics drains for the projects you select.
- Vercel (manual log source, cloud platforms): Create a Vercel log drain pointed at your Sazabi intake URL to forward deployment logs from serverless functions, edge functions, and static builds.
What Sazabi detects from these logs today
These detections are on for every production project, with no monitors or alert rules to write. Sazabi opens an issue when one fires.
- Novel event: A kind of error that has never appeared before.
Frequently Asked Questions
Can I send Vercel logs to Sazabi on the Hobby plan?
No. Vercel Drains need a Pro or Enterprise team. Hobby and Pro Trial teams cannot create drains, on either the native or the manual path, and personal-account projects cannot be connected because drains belong to a team.
What is the difference between connecting my account and creating a log drain myself?
Connecting with a team-scoped API token lets Sazabi create and maintain log, trace and Web Analytics drains per project. A log drain you create in Team Settings and point at your Sazabi intake URL carries logs only.
Why do my manual log drain records look malformed?
The delivery format of the log drain must be JSON. Sazabi does not parse NDJSON on the manual endpoint, so NDJSON payloads are not processed correctly.
Can the Sazabi agent run Vercel commands?
Yes, if you connect the Vercel CLI as a sandbox CLI with a VERCEL_TOKEN. The agent can then run the vercel command in an investigation thread. This is separate from the drains and is configured on its own.
Sources
- Native connection creates log, trace and Web Analytics drains per project, needs a team-scoped API token and the Vercel Pro or Enterprise plan (accessed Nov 8, 2026)
- Manual log drain covers logs only, must use JSON delivery format because Sazabi does not parse NDJSON, accepts every Vercel log source (accessed Nov 8, 2026)
- The Vercel CLI runs in the Sazabi agent sandbox with a VERCEL_TOKEN (accessed Nov 8, 2026)
- Log drain schema fields (source, level, statusCode, requestId, traceId, proxy.wafRuleId), JSON and NDJSON formats, 256 KB message truncation, sampling rules, statusCode -1 for a crashed lambda (accessed Nov 8, 2026)
- Drains are available on Enterprise and Pro plans; the schema names are log, trace, analytics, speed_insights, audit_log and connect (accessed Nov 8, 2026)