Mode 3 is a live subscription (for example Cloud Logging → Pub/Sub). Each account has stream rows with status pending, active, paused, or error.
· Paused streams drop ingest (acknowledged, not published).
· Last received time and accepted / discarded counts appear on the stream.
· Mode 3 accepted events still go through mapping apply and the same daily entitlement as Mode 2.
· Raw Mode 3 event rows are not stored unless you opt into the recommended 24 hours on Account (or buy a 7 / 30 / 90 / 365-day add-on). You may choose 0 hours and 0 seconds. Mapping apply and rollups still run.
If a stream is error or paused, check Account / Settings streams before assuming risk went down. Quiet can mean ingest is not attached.
Machine POST /api/v1/events/ingest (API key / OAuth2, Connector ID, Ed25519 signature) is a different path than Connect live stream.
See Live streams vs connectors — where do the keys go?