Audit Log Fields

Table of Contents

Finding Audit Logs
Events Captured
Facets

Audit logs capture authentication events and every change a user makes to platform configuration: users, groups, policies, dashboards, alert rules, scheduled views, pipelines, and more. Read-only operations are not recorded. Data queries are recorded separately in the performance logs. Every audit field is indexed as a Facet.

Finding Audit Logs

Each service writes its audit logs under its own source. Every audit entry carries the audit_log facet, so filter on that:

Filter What it selects

Filter	What it selects
`@audit_log="true"`	All audit log entries across all services. Use this as the base filter for all audit queries.
`source="user-mgmt-service" and @audit_log="true"`	Audit entries from a single service

@audit_log="true"

All audit log entries across all services. Use this as the base filter for all audit queries.

source="user-mgmt-service" and @audit_log="true"

Audit entries from a single service

The source tells you which service performed the action:

source Events recorded

`source`	Events recorded
`user-mgmt-service`	Login and logout events, MCP client authorization, users, groups, service accounts, policies, folders and folder permissions, dashboards, alert rules, silences, contact points, notification policies, and mute timings
`config-mgmt-service`	Derived metrics, logs pipelines, ingest auth keys, rate control, metric shaping rules, remap configuration, and federation membership
`logs-query-service`	Lookup tables, dimension tables, favorite facets, and scheduled views
`trace-query-service`	SLOs
`archive-writer`	Archive management — Admin-only when RBAC is enabled, and audited starting with Release 4.3.0
`hydration-service`	Hydration jobs — Admin-only when RBAC is enabled, and audited starting with Release 4.3.0
`zapper`	Data deletion jobs
`beffe`	Workbooks
Any query service	`authorization_failure` events for denied requests

user-mgmt-service

Login and logout events, MCP client authorization, users, groups, service accounts, policies, folders and folder permissions, dashboards, alert rules, silences, contact points, notification policies, and mute timings

config-mgmt-service

Derived metrics, logs pipelines, ingest auth keys, rate control, metric shaping rules, remap configuration, and federation membership

logs-query-service

Lookup tables, dimension tables, favorite facets, and scheduled views

trace-query-service

SLOs

archive-writer

Archive management — Admin-only when RBAC is enabled, and audited starting with Release 4.3.0

hydration-service

Hydration jobs — Admin-only when RBAC is enabled, and audited starting with Release 4.3.0

zapper

Data deletion jobs

beffe

Workbooks

Any query service

authorization_failure events for denied requests

Events Captured

The action facet names the event and resource_type names what it acted on. Action values are written exactly as the service emits them, so some are lower-case and some are mixed-case.

Authentication events
`action`	`resource_type`	Trigger
`logged in`	`auth`	Successful login through SSO or basic auth
`logged out`	`auth`	User-initiated logout
`user locked`	`auth`	Failed login attempt on a locked account
`mcp.register`	`oauth_client`	An MCP client registered itself for OAuth. `resource_name` is the client name, for example `Claude` or `Windsurf`.
`mcp.login`	`oauth_session`	A user completed the MCP OAuth login
`mcp.token.code_grant`	`oauth_session`	An MCP client exchanged an authorization code for a token
`mcp.token.refresh`	`oauth_session`	An MCP client refreshed its token

User, group, and service account events
`action`	`resource_type`	Trigger
`create`, `update`, `delete`	`user`	A user account was created, modified, or deleted
`create`, `update`, `delete`	`group`	A group was created, modified, or deleted
`add_user_to_group`, `remove_user_from_group`	`group`	Group membership changed. `resource_name` is the group and `resource_id` is the user.
`create`, `update`, `delete`	`service_account`	A service account was created, modified, or deleted
`create_token`, `delete_token`	`service_account`	A service account token was issued or revoked

Policy and authorization events
`action`	`resource_type`	Trigger
`create`, `update`, `delete`	`policy`	A policy was created, modified, or deleted
`create_mapping`, `delete_mapping`	`policy_mapping`	A policy was mapped to, or unmapped from, a user or group
`create`, `update`, `delete_mapping`	`folder_mapping`	A folder permission mapping was created, updated, or removed
`authorization_failure`	`GraphQLMutation` or `REST Modification operation`	A request was denied because the caller lacked sufficient permissions

Folder and dashboard events
`action`	`resource_type`	Trigger
`create`, `update`	`folder`	A folder was created or renamed
`DeleteFolder`	`folder`	A folder was deleted
`CreateDashboard`, `UpdateDashboard`, `DeleteDashboard`	`Dashboard`	A dashboard was created, saved, or deleted

Alerting events
`action`	`resource_type`	Trigger
`CreateAlertRule`, `UpdateAlertRule`, `DeleteAlertRule`	`AlertRule`	An alert rule was created, modified, or deleted
`pause`, `resume`	`AlertRule`	An alert rule was paused or resumed
`Overwritten`	`AlertRuleGroup`	A rule group was replaced in full, for example by a provisioning API call
`CreateSilence`	`Suppressed Alert(s)`	An alert silence was created
`CreateContactPoint`, `UpdateContactPoint`, `DeleteContactPoint`	`ContactPoint`	A contact point was created, modified, or deleted
`UpdateNotificationPolicies`	`NotificationPolicy`	The notification policy tree was changed
`DeleteMuteTiming`	`MuteTiming`	A mute timing was deleted
`DeleteAlertConfig`	`AlertmanagerConfig`	The Alertmanager configuration was reset

Logs configuration events
`action`	`resource_type`	Trigger
`EditLookupTable`	`LookupTable`	A lookup table was uploaded or replaced
`CreateDimensionTable`	`DimensionTable`	A dimension table was created
`AddFavoriteFacet`, `EditFavoriteFacet`, `RemoveFavoriteFacet`	`FavoriteFacet`	A favorite facet was added, edited, or removed
`createScheduledView`, `EditScheduledView`, `pauseScheduledView`, `resumeScheduledView`, `stopScheduledView`	`ScheduledView`	A scheduled view was created, edited, paused, resumed, or stopped

Platform configuration events
`action`	`resource_type`	Trigger
`CreateDerivedMetric`, `UpdateDerivedMetric`, `DeleteDerivedMetric`, `PauseDerivedMetric`, `ResumeDerivedMetric`, `DeleteDerivedMetricsByFolder`	`DerivedMetric`	A derived metric was created, modified, deleted, paused, or resumed
`CreateLogsPipeline`, `UpdateLogsPipelineDraft`, `PublishLogsPipeline`, `SetLogsPipelineEnabled`, `ReorderLogsPipelines`, `DeleteLogsPipeline`	`LogsPipeline`	A logs pipeline was created, drafted, published, enabled or disabled, reordered, or deleted
`CreateAuthKeyLabel`, `UpdateAuthKeyLabel`, `DeleteAuthKeyLabel`	`AuthKeyLabel`	An ingest auth key label was created, modified, or deleted
`AddAuthKeyToken`, `DeleteAuthKeyToken`	`AuthKeyToken`	An ingest auth key token was issued or revoked
`AddOrUpdateRateControlPolicy`, `DeleteRateControlPolicy`	`RateControlPolicy`	A rate control policy was saved or deleted
`AddOrUpdateRateControlClassLabelRules`, `DeleteRateControlClassLabelRules`	`RateControlClassLabelRules`	Rate control class label rules were saved or deleted
`CreateMetricShapingRule`, `UpdateMetricShapingRule`, `DeleteMetricShapingRule`	`MetricShapingRule`	A metric shaping rule was created, modified, or deleted
`UpdateRemapConfig`	`RemapConfig`	The label remap configuration was changed

Federation, SLO, and other events
`action`	`resource_type`	Trigger
`federation.join`	`auth`	A remote cluster joined the federation
`InitializeFederation`, `LeaveFederation`, `DisbandFederation`, `RemoveCluster`	`Federation`, `FederationCluster`	Federation membership was changed
`createSlo`, `editSlo`, `deleteSlo`	`SLO`, `SLO - Latency`, `SLO - Custom`	An SLO was created, modified, or deleted
`cancelDeletionJob`	`cancelDeletionJob`	A data deletion job was cancelled
`createWorkbook`	`Workbook`	A workbook was created

Archive and hydration events (audited starting with Release 4.3.0)
`action`	`resource_type`	Trigger
`create`, `update`, `start`, `stop`, `delete`	`archive`	An archive was created, edited, started, stopped, or deleted through the Archives screen or the archive REST API. Recorded for every attempt when audit logging is enabled, whether it was allowed or denied by RBAC.
`hydrate`, `pause`, `resume`, `cancel`	`hydration_job`	A hydration job was started, paused, resumed, or cancelled. Recorded for every attempt when audit logging is enabled, whether it was allowed or denied by RBAC.

All audit log fields are indexed as Facets and appear in the Facets panel on the left side of the Logs UI. Clicking a facet value adds it immediately as a filter to the current query.

Facet Type Values / Notes

Facet	Type	Values / Notes
`action`	string	Event name. See Events Captured.
`resource_type`	string	Kind of resource acted on. See Events Captured.
`resource_name`	string	Human-readable name of the affected resource: user email, group name, dashboard title, alert rule name, and so on
`resource_id`	string	Unique ID of the affected resource. Falls back to `resource_name` when no distinct ID exists.
`user_email`	string	Email of the user who performed the action, or the service account name
`user_id`	string	Identity provider ID of the acting user
`user_role`	string	Role of the acting user: `Admin`, `Editor`, or `Viewer`
`status_1`	string	`success` or `failure`
`error_code`	string	HTTP status code on failure, for example `403`. `none` on success.
`error_message`	string	Error detail on failure. `none` on success.
`duration_ms`	integer	How long the operation took, in milliseconds
`request_id`	string	Request identifier for cross-service correlation
`session_ip`	string	Client IP address, taken from `X-Forwarded-For` when the request arrived through a proxy
`user_agent`	string	HTTP User-Agent of the calling client
`args`	string	Additional context for the operation, present only on some events. For example, `mcp.register` records the client’s redirect URIs.
`msg`	string	Human-readable summary, for example `AlertRule was deleted by alice@example.com`

action

string

Event name. See Events Captured.

resource_type

string

Kind of resource acted on. See Events Captured.

resource_name

string

Human-readable name of the affected resource: user email, group name, dashboard title, alert rule name, and so on

resource_id

string

Unique ID of the affected resource. Falls back to resource_name when no distinct ID exists.

user_email

string

Email of the user who performed the action, or the service account name

user_id

string

Identity provider ID of the acting user

user_role

string

Role of the acting user: Admin, Editor, or Viewer

status_1

string

success or failure

error_code

string

HTTP status code on failure, for example 403. none on success.

error_message

string

Error detail on failure. none on success.

duration_ms

integer

How long the operation took, in milliseconds

request_id

string

Request identifier for cross-service correlation

session_ip

string

Client IP address, taken from X-Forwarded-For when the request arrived through a proxy

user_agent

string

HTTP User-Agent of the calling client

args

string

Additional context for the operation, present only on some events. For example, mcp.register records the client’s redirect URIs.

msg

string

Human-readable summary, for example AlertRule was deleted by alice@example.com