Audit Log Data

Audit logs capture authentication and authorization mutation events on the Kloudfuse platform. Each entry is a JSON object whose fields are indexed as Facets.

Finding Audit Logs

You can find audit logs using either filter:

Filter What it selects

source="kf-audit-log"

All audit log entries across all services

audit_log="true"

Equivalent; matches the raw field written into each log entry

Use source="kf-audit-log" as the base filter for all audit queries.

Events Captured

Audit logs record mutation and authentication events. Read-only operations and queries are not recorded.

Authentication events
action value Trigger

logged in

Successful login via SSO or basic auth

logged out

User-initiated logout

user locked

Failed login attempt on a locked account

federation.join

A remote cluster joined the federation
User management events
action value Trigger

create

A user account was created (resource_type: user)

update

A user account was modified, including query priority changes

delete

A user account was deleted
Group management events
action value Trigger

create

A group was created (resource_type: group)

update

A group was modified

delete

A group was deleted

add_user_to_group

A user was added to a group

remove_user_from_group

A user was removed from a group
Service account events
action value Trigger

create

A service account was created (resource_type: service_account)

update

A service account was modified

delete

A service account was deleted

create_token

A service account token was issued

delete_token

A service account token was revoked
Policy and authorization events
action value Trigger

create

A policy was created (resource_type: policy)

update

A policy was modified

delete

A policy was deleted

create_mapping

A policy was mapped to an entity

delete_mapping

A policy mapping was removed

authorization_failure

A request was denied because the caller lacked sufficient permissions
Dashboard and folder events
action value Trigger

create / update

A folder permission mapping was created or updated (resource_type: folder_mapping)

delete_mapping

A folder permission mapping was removed

DeleteFolder

A dashboard folder was deleted

Facets

All audit log fields are indexed as Facets and appear in the Facets panel on the left side of the Logs UI. Clicking a facet value adds it immediately as a filter to the current query.

Facet Type Values / Notes

action

string

logged in, logged out, user locked, create, update, delete, add_user_to_group, remove_user_from_group, create_token, delete_token, create_mapping, delete_mapping, authorization_failure, DeleteFolder, federation.join

user_email

string

Email address of the user who performed the action

role

string

admin or editor

resource_type

string

auth, user, group, service_account, policy, policy_mapping, folder_mapping, class_default

resource_name

string

Human-readable name of the affected resource — user email, group name, policy name, and so on

status

string

success or failure

error_code

string

HTTP status code on failure (for example 403); none on success

duration_ms

integer

How long the operation took in milliseconds

All Log Fields

In addition to the facets above, each audit log entry carries the following fields in the log body:

Field Type Description

resource_id

string

Unique ID of the affected resource; falls back to resource_name when no distinct ID exists

user_id

string

Internal ID of the acting user

user_agent

string

HTTP User-Agent of the calling client

request_id

string

Unique request identifier for cross-service correlation

error_message

string

Error detail on failure; none on success

args

string

Additional context for the operation (varies by action type)