Audit log reference

This reference contains the JSON structure and field descriptions for events collected by Audit Trails. Use it to analyze audit logs, build search queries, and configure filtering. Management and data events are provided together.

Each event page has two sections:

• Event JSON schema: Event record structure, including nested objects and arrays.
• Field description: Description of fields, their types, and possible values.

This reference lists the possible fields for each event. The fields available in an actual log depend on the event and resource parameters.

Field names in the reference and logsField names in the reference and logs

The reference uses camelCase for compound field names, while audit logs generally use snake_case, with lowercase letters and _ as separators. When matching paths, pay attention to the naming convention and casing of each nested field.

Here is an example for a BucketUpdate event:

Single-word names, such as details, remain unchanged. This rule applies to field names, not field values: the event type remains yandex.cloud.audit.storage.BucketUpdate.

Nested data may retain the format used by the source service. When building queries and configuring filters, use the exact key names and casing from the actual JSON log.