Skip to main content
This page describes the fields included in each audit log event type. Payloads can contain Omni metadata, which can be safely ignored.

​
Query context events

Occurs when a user loads a document (workbook or dashboard). Event type: QUERY_CONTEXT
​
documentIdentifier
string
The unique ID of the workbook or dashboard within Omni, found within the URL for the document.
​
embedEntity
string
If applicable, the value will be the value of the entity field in an embed URL generated for a user.
​
event
string
The type of the event. This will be QUERY_CONTEXT.
​
message
string
Additional detail passed from the log.
​
organizationID
string
The unique identifier for the Omni organization.
​
organizationUserID
string
The unique identifier for the Omni user associated with the event.
​
queryCount
number
The maximum number of query execution events that a query context event can trigger. Can be used to calculate cache hit rate as the denominator.
​
referrer
string
The URL of the page where the event was issued.
​
source
string
The source of the query context event: dashboard or workbook.
​
timestamp
string
The time the event occurred.
​
traceID
string
A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run.
​
url
string
The URL of the page where the event occurred.

​
Query execution events

Occurs when a user runs a query, which may be sent back to the warehouse. Event type: QUERY_EXECUTE
​
@timestamp
string
The time the event occurred.
​
duration
number
The total length of query execution within the warehouse.
​
event
string
The type of the event. This will be QUERY_EXECUTE.
​
jobId
string
The ID of the corresponding job in the warehouse where the query was executed.
​
message
string
Detail passed from the infrastructure back to the user, if applicable.
​
omniQueryID
string
A uuid for the query being executed within Omni. Used for query killing purposes.
​
organizationID
string
The unique identifier for the Omni organization.
​
query
string
The query that was executed.
​
traceID
string
A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run.
​
success
boolean
Indicates if the query executed successfully. Note: This doesn’t indicate the success of the job, only the individual query.

​
Dashboard download events

Occurs when a user downloads a full dashboard. Event type: DASHBOARD_DOWNLOAD
​
documentIdentifier
string
The unique ID of the workbook or dashboard within Omni, found within the URL for the document.
​
embedEntity
string
If applicable, the value will be the value of the entity field in an embed URL generated for a user.
​
event
string
The type of the event. This will be DASHBOARD_DOWNLOAD.
​
message
string
Additional detail passed from the log.
​
organizationID
string
The unique identifier for the Omni organization.
​
organizationUserID
string
The unique identifier for the Omni user associated with the event.
​
timestamp
string
The time the event occurred.
​
traceID
string
A uuid that can be used to trace the event across other log entries. For example, from a query context or dashboard download event to the query execution events that were subsequently run.
​
url
string
The URL of the page where the event occurred.

​
Connection base role events

Occurs when the base role for a connection changes. Event type: UPDATE_CONNECTION_BASE_ROLE
​
actor
object
Details about the Omni user associated with the event.
​
connectionID
string
The ID of the connection associated with the role change.
​
event
string
The type of the event. This will be UPDATE_CONNECTION_BASE_ROLE.
​
message
string
Additional detail passed from the log.
​
roleDefinitionName
string
The name of the updated base connection role.
​
timestamp
string
The time the event occurred.
​
traceID
string
A uuid that can be used to trace the event across other log entries.

​
User connection role events

Occurs when a user’s connection role changes. Event type: UPDATE_USER_CONNECTION_ROLE
​
connectionId
string
The ID of the connection associated with the role change.
​
event
string
The type of the event. This will be UPDATE_USER_CONNECTION_ROLE.
​
message
string
Additional detail passed from the log.
​
organizationID
string
The unique identifier for the Omni organization.
​
organizationUserID
string
The unique identifier for the Omni user associated with the event.
​
timestamp
string
The time the event occurred.
​
traceID
string
A uuid that can be used to trace the event across other log entries.

​
User group connection role events

Occurs when the connection role for a user group changes. Event type: UPDATE_GROUP_CONNECTION_ROLE
​
actor
object
Details about the Omni user associated with the event.
​
connectionId
string
The ID of the connection associated with the role change.
​
event
string
The type of the event. This will be UPDATE_GROUP_CONNECTION_ROLE.
​
message
string
Additional detail passed from the log.
​
organizationID
string
The unique identifier for the Omni organization.
​
roleDefinitionName
string
The name of the updated connection role.
​
targetMembershipID
string
The membership of the user group associated with the event.
​
timestamp
string
The time the event occurred.
​
traceID
string
A uuid that can be used to trace the event across other log entries.
​
userGroupId
string
The ID of the Omni user group associated with the event.

​
User invite events

Occurs when a new user is invited to the organization. Event type: USER_INVITE
​
event
string
The type of the event. This will be USER_INVITE.
​
invitedOrganizationUserId
string
The ID of the invited user.
​
message
string
Additional detail passed from the log.
​
organizationID
string
The unique identifier for the Omni organization.
​
organizationUserID
string
The unique identifier for the Omni user associated with the event.
​
timestamp
string
The time the event occurred.
​
traceID
string
A uuid that can be used to trace the event across other log entries.