Audit logs

Examine user actions by logging them into an HTTP log drain.

Enable audit logs

Use Better Stack to store and examine your audit logs.

1. Start by creating a Logs source

• Create an HTTP logs source in Logs → Sources → Connect source.
• Name the source: Audit logs.
• Copy Source token and Ingesting host.

2. Set up audit logs

• Navigate to Better Stack → Organization → Features.
• Enable Audit logs toggle.
• Fill in the URL: https://$INGESTING_HOST/. Use the Ingesting host you've copied earlier instead of $INGESTING_HOST.
• Header name: Authorization.
• Header value: Bearer $SOURCE_TOKEN. Use the Source token you've copied earlier instead of $SOURCE_TOKEN.

3. Check your audit logs

You should see your audit logs in Logs → Live tail.

Want to send your audit logs somewhere else?

Use any URL, and we’ll send your audit logs there. We’ll use a POST request with audit logs in JSON format.

Audit logs format

Example of an audit log of a user deleting a monitor:

{
    "email": "simon@betterstack.com",
    "event": "DELETE request",
    "ip": "89.24.32.123",
    "message": "Simon Let <simon@betterstack.com> (user ID 123, team ID 456, organization ID 789) sent a GET request from 89.24.32.123 to https://uptime.betterstack.com/team/456/monitors/175",
    "name": "Simon Let",
    "organization_id": 789,
    "team_id": 456,
    "url": "https://uptime.betterstack.com/team/3/monitors/175",
    "user_id": 123
}

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏