Log Stream Query Logs

Last modified on August 26, 2024

FieldTypeDescriptionExample
actorAccountIDStringUnique identifier of the account that performed the query"a-0abcdabcdab00000"
actorEmailStringEmail of the account that performed the query, at the time the query was executed"alice.glick@example.com"
actorExternalIDStringExternal ID of the account that performed the query, at the time the query was executed"e-bca5454"
actorFirstNameStringGiven name of the account that performed the query, at the time the query was executed"Alice"
actorLastNameStringFamily name of the account that performed the query, at the time the query was executed"Glick"
actorTagsObjectTags of the account accessed, at the time the query was executed{ "tag1": "val1", "tag2": "val2" }
authenticationIdStringAuthentication of the account associated with this query"auth-0000000000000001"
authzObjectAuthorization metadata from the policy evaluation associated with this query; only included for Enterprise organizations that have a policy in place that this event triggered{ "formatVersion": "v1.0.0", "entities": {}, "context": {}, "requests": [], "requirements": { "error": "", "requirements": {}, "decision": "allow" }
clientCommandStringCommand executed on the client for a Kubernetes session."kubectl describe pods"
clientIPStringIP address the query was performed from, as detected at the StrongDM control plane"1.11.222.333"
commandStringCommand executed over an SSH or Kubernetes session"echo hi"
containerStringTarget container of a Kubernetes operation"nginx"
durationMsIntegerDuration of the query in milliseconds200
egressNodeIDStringUnique ID of the node through which the resource was accessed"n-56988fae64a73652"
formatVersionStringVersion of the log format"v1.0.0"
hashStringHash of the body of the query"0da22222ba9b212ecfed33a17147c466ae0929fb"
headersObjectHTTP headers of a Kubernetes operation{ "header1": "value1", "header2": "value2" }
identityAliasStringUsername of the IdentityAlias used to access the resource"alice.glick"
isShellBooleanWhether the query was executed in a shellfalse
logTypeStringType of log, always “queries” for query logs"queries"
podStringTarget pod of a Kubernetes operation"kube-dns-v20-8gsbl"
queryStringCaptured content of the query; for queries against SSH, Kubernetes, and RDP resources, this contains a JSON representation of the QueryCapture"select name from users"
queryCategoryStringGeneral category of resource against which query was performed"k8s", "queries" (datasources), "rdp", "ssh", "web", "cloud", "all"
requestBodyStringHTTP request body of a Kubernetes operation
requestMethodStringHTTP request method of a Kubernetes operation
requestURIStringHTTP request URI of a Kubernetes operation
resourceIDStringUnique identifier of the resource against which the query was performed"r-1caa595464152e78"
resourceNameStringName of the resource accessed, at the time the query was executed"MySQL"
resourceTagsObjectTags of the resource accessed, at the time the query was executed{"env": "dev"}
resourceTypeStringSpecific type of resource against which query was performed"mysql"
rowCountIntegerNumber of records returned by the query, for a database resource18
sourceIPStringIP address the query was performed from, as detected at the ingress gateway; will be an internal address if the gateway is on the same local network or VPN as the client"1.11.222.333"
targetStringTarget destination of the query, in host:port format"3.33.222.111:5432"
timestampStringTime at which the query was started, formatted as datetime"2024-08-01T13:13:20.895597162Z"
uuidStringUnique identifier of the query"0CEGCEGCEGCEGCEGCEGCE1234ceg"