---
title: Replay
description: >-
  Learn about using Replay to pull archived logs and process them in
  Observability Pipelines.
breadcrumbs: Docs > Observability Pipelines > Replay
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Replay

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Replay for Observability Pipelines enables you to pull archived logs from object storage and process them in Observability Pipelines, including with [Packs](https://docs.datadoghq.com/observability_pipelines/packs.md). This gives you consistent access to historical context without having to rebuild workflows or modify ingestion pipelines.

Organizations often store large volumes of logs in cost-efficient, long-term archives to control spend and meet compliance requirements. However, historical data often becomes difficult to access when there is a security incident, audit request, or operational investigation. Retrieving archived logs from cold storage can be slow, manual, and disruptive, requiring ad-hoc scripts, decompression, or dedicated engineering effort. Replay for Observability Pipelines solves these issues.

{% image
   source="https://docs.dd-static.net/images/observability_pipelines/replay_pipeline.2ad667f099d9e7c934ec3e63cae31cb1.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/observability_pipelines/replay_pipeline.2ad667f099d9e7c934ec3e63cae31cb1.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="A pipeline with the Amazon S3 replay source." /%}

## How Replay works{% #how-replay-works %}

Replay provides an automated workflow for retrieving and reprocessing archived logs stored in object stores, such as Amazon S3, Google Cloud Storage, and Azure Blob Storage. This helps you balance storage efficiency with quick access to historical data.

With Replay, you can:

### Retrieve archived logs on demand{% #retrieve-archived-logs-on-demand %}

Pull only the data you need for investigations, audits, troubleshooting, or pipeline testing, and eliminate long retrieval delays and manual extraction steps.

### Target specific time ranges or event slices{% #target-specific-time-ranges-or-event-slices %}

Specify the exact time frame or subset of events you need to prevent moving or processing data unnecessarily.

### Process historical logs with Observability Pipelines{% #process-historical-logs-with-observability-pipelines %}

Replayed logs go through the same parsing, enrichment, normalization, and routing logic applied to live log streams.

This ensures:

- Consistent formatting and field extraction
- Reliable enrichment (for example, user, geo-IP, and cloud metadata)
- Uniform security and compliance controls
- Identical behavior across historical and real-time data

### Route replayed data to any supported destination{% #route-replayed-data-to-any-supported-destination %}

You can send processed historical logs to SIEMs, data lakes, analytics platforms, or any Observability Pipelines destination.

### Eliminate manual handling{% #eliminate-manual-handling %}

Replay provides a structured, predictable way to pull archived data back into your observability platform, so you don't have to use custom scripts, manual decompression, or ad-hoc retrieval processes.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Learn more about processors](https://docs.datadoghq.com/observability_pipelines/processors.md)
- [Learn more about Packs](https://docs.datadoghq.com/observability_pipelines/packs.md)
- [Rehydrate archived logs in any SIEM or logging vendor with Observability Pipelines](https://www.datadoghq.com/blog/rehydrate-archived-logs-with-observability-pipelines)