---
title: Live Capture
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Observability Pipelines > Configuration > Live Capture
---

# Live Capture

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site). ().
{% /alert %}

{% /callout %}
Available for:
{% icon name="icon-logs" /%}
 Logs | 
{% icon name="icon-metrics" /%}
 Metrics 
## Overview{% #overview %}

Use Live Capture to see the data a source sends through the pipeline and also the data a processor receives and sends out. Specifically, the following information is shown:

- The timestamp of when the data was received
- The data that was sent out and whether it was:
  - Modified
  - Unmodified
  - Dropped
  - Reduced

An example of Live Capture showing the log's `message` field before and after it has been processed by the Parse JSON processor.

{% image
   source="https://datadog-docs.imgix.net/images/observability_pipelines/live_capture_parse_json.3057b81b81e850a9c5e73848718c0d05.png?auto=format"
   alt="The entry column shows the original message field's values and the exit column shows the values parsed as JSON" /%}

## Permissions{% #permissions %}

Only users with the `Observability Pipelines Live Capture Write` permission can set up captures. Users with the `Observability Pipelines Live Capture Read` permission can only view the events that have already been captured. See [Observability Pipelines Permissions](https://docs.datadoghq.com/account_management/rbac/permissions/#observability-pipelines) for a list of permissions for Observability Pipelines assets.

Admins have read and write permissions by default. Standard users only have read permission by default. See [Access Control](https://docs.datadoghq.com/account_management/rbac/) for more information about default Datadog roles and how to create custom roles.

### Add domains to firewall allowlist{% #add-domains-to-firewall-allowlist %}

If you want to use Live Capture and are using a firewall, you must add these domains to the allowlist:

- `api.`
- `obpipeline-intake.`
- `config.`

## Capture events{% #capture-events %}

1. Navigate to [Observability Pipelines](https://app.datadoghq.com/observability-pipelines).
1. Select your pipeline.
1. Click the cog for the source or processor that you want to capture events for.
1. Select **Capture and view events** in the side panel.
1. Click **Capture**.
1. **Optional configurations**:
   {% image
      source="https://datadog-docs.imgix.net/images/observability_pipelines/live_capture_optional_config.f2ecfd39b7c6cfbd0858a9fb64e2b24b.png?auto=format"
      alt="The Live Capture optional configuration modal showing the filter query, capture duration, and Worker selection options" /%}
**Note**: Optional configurations are only available if all active Workers are version 2.13 or later.
   1. Enter a query to specify which events you want to capture. For more information, see [Search Syntax for Logs](https://docs.datadoghq.com/observability_pipelines/search_syntax/logs) or [Search Syntax for Metrics](https://docs.datadoghq.com/observability_pipelines/search_syntax/metrics).
   1. Enter a capture duration (in seconds or minutes) for how long you want events to be captured.
      - Minimum duration (default if no duration is specified): 30 seconds
      - Maximum duration: 300 seconds (5 minutes)
   1. Select which Workers you want to capture events from. If no Workers are selected, a random Worker is chosen.
1. Click **Capture** to start capturing events.**Note**: It might take up to 60 seconds for captured events to appear in the UI. Captured data is visible to all users with view access, and is stored in the Datadog Platform for 72 hours.
1. After the capture is complete:
   1. Click a specific captured event to see the data that was received and sent out. You can also search for specific events in the search bar. Use the dropdown menu next to the search bar to show events based on status (`MODIFIED`, `UNMODIFIED`, `DROPPED`, and `REDUCED`).
   1. In the **Workers - Capture Execution Details** section, click **View Logs** to see the Worker logs for the capture.
1. To see other captures for the same component, click **Captures** on the top left of the side panel. **Note**: Viewing other captures only applies if all active Workers are version 2.13 or later.
   - You can filter captures by capture event ID, filter query, pipeline version, or status (`in_progress` or `completed`).
   - For the **Total Events** column, the maximum captured events per Worker is 200 when including both the input and output of an event.

## Further reading{% #further-reading %}

- [Set up pipelines](https://docs.datadoghq.com/observability_pipelines/configuration/set_up_pipelines/)