Yandex Audit Trails event reference
Written by
Updated at July 29, 2026
Audit Trails supports monitoring of both control plane (configuration level) and data plane (service level) events for Yandex Managed Service for OpenSearch.
The event_type field value format is as follows:
yandex.cloud.audit.mdb.opensearch.<event_name>
Control plane event reference
| Event name | Description |
|---|---|
AddDashboardsNodeGroup |
Adding a Dashboards type host group |
AddOpenSearchNodeGroup |
Adding an OpenSearch type host group |
BackupCluster |
Creating a backup |
CreateCluster |
Creating a cluster |
DeleteCluster |
Deleting a cluster |
DeleteBackup |
Deleting a backup |
DeleteDashboardsNodeGroup |
Deleting a Dashboards type host group |
DeleteOpenSearchNodeGroup |
Deleting an OpenSearch type host group |
MoveCluster |
Moving a cluster |
RescheduleMaintenance |
Changing scheduled maintenance date and time |
RestartOpenSearch |
Restarting a cluster |
RestoreCluster |
Creating a new cluster from a backup |
StartCluster |
Starting a cluster |
StopCluster |
Stopping a cluster |
SetClusterAccessBindings |
Assigning access permissions for a cluster |
SwitchMaster |
Changing the host quorum leader with the MANAGER role |
UpdateCluster |
Updating a cluster |
UpdateClusterAccessBindings |
Updating access permissions for a cluster |
UpdateDashboardsNodeGroup |
Updating a Dashboards type host group |
UpdateOpenSearchNodeGroup |
Updating a OpenSearch type host group |
Data plane event reference
| Event name | Description |
|---|---|
ComplianceReadEvent |
Reading data in accordance to security requirements |
ComplianceWriteEvent |
Writing data in accordance with security requirements |
FailedLoginRestEvent |
Failed authentication attempt when executing a REST request |
GrantedPrivilegesRestEvent |
Granting access permissions to execute REST requests |
GrantedPrivilegesTransportEvent |
Granting access permissions to execute internal requests |
MissingPrivilegesRestEvent |
Not enough access permissions to execute REST requests |
MissingPrivilegesTransportEvent |
Not enough access permissions to execute internal requests |
SecurityIndexAttemptTransportEvent |
Attempt to access a security index via an internal request |