Skip to main content

Audit Logs

Currently, we offer audit logs for query context and query execution events within Omni. These logs will be structured as a JSON payload, and they can be exported to an S3 bucket - please contact your Omni account team to get this configured. Logs are batched out to S3 a few minutes after being written to the logs. They can be retained for up to one year. You may see additional entries in the payload, which correspond to internal Omni metadata that can be ignored.

Query Context log field definitions​

documentIdentifier​

The unique ID of your workbook or dashboard within Omni found within the URL for that document

event​

The name of the audit log event (query_context, query_execution). Query context is the event that occurs when a user loads a document (workbook or dashboard) and query execution are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a query_context event but may not be a corresponding query_execution event as cache hits do not trigger a query_execution

message​

Additional detail passed from the log to the user such as the query being executed if applicable

organizationID​

A unique identifier for your organization within Omni

organizationUserID​

This unique identifier for a given user within Omni and can be used to look up a user at https://<your-environment>.omniapp.co/users.

referrer​

The URL of the document that triggered the event. Referrers with dashboard within them are query_context events from a dashboard, whereas those that have a set of key-value pairs are from a workbook

timestamp​

When the event occurred

traceID​

A uuid for tracing the event across the logs from a query_context event to query_execution

url​

Where the query_context or query_execution event originated from

queryCount​

This will show the maximum amount of query execution events that a query context event can trigger. Can be used to calculate cache hit rate as the denominator.

source​

Will delineate if the query context event came from a dashboard or workbook

embedEntity​

Returns whatever is in the entity field in the embed URL that is generated for that user if applicable

Query Execution log field definitions​

timestamp​

When the event occurred

duration​

The total length of query execution within the warehouse

event​

The name of the audit log event (query_context, query_execution). Query context is the event that occurs when a user loads a document (workbook or dashboard) and query execution are the subsequent query run(s) that may be sent back to the warehouse. In the event some or all queries hit the cache, there will still be a query_context event but may not be a corresponding query_execution event as cache hits do not trigger a query_execution jobID: the corresponding query jobID in the given warehouse where the query is executed

message​

The detail passed from the infra back to the user if applicable

omniQueryID​

A uuid for the query being executed within Omni used to track for query killing

organizationID​

A unique identifier for your organization within Omni

query​

The query that was executed

traceID​

A uuid for tracing the event across the logs from a query_context event to query_execution