Skip to main content

Customization options for Audit Trail webhook payload

Feature RequestsObservabilityIntegrations

The payload format of the Spacelift Audit Trail logs sent to an external endpoint should be able to be customized similar to when using a Notification Policy to send to a webhook. Further payload customization options would better enable the Audit Trail logs to be sent directly third-party observability or SIEM systems in their native format without the need for intermediary transformation or ingestion.

Workaround
Problem
Status: ⬆️ Gathering votes2 comments

Log in to comment and vote

Comments2

  • Black Breeze

    •

    Feb 12

    I hear you. Though I’m wondering - many log ingestion systems have a way to parse/modify the payload on the fly so that you don’t need to pass it through an external process. The reason they do it is that sometimes you simply have no control over the payload formatting for one reason or another. Have you looked into the possibility of doing it natively with Datadog?

    • Azure Breeze

      •

      Feb 13

      Hey Marcin, thanks for your reply.
      I had looked fairly thoroughly at doing this natively with Datadog and didn’t believe I could. However, you’ve prompted me to review it again and it turns out that I was wrong. The Datadog log ingestion API docs show a fairly specific payload structure with required fields. I’ve done some testing today and found that those fields actually aren’t required and that the endpoint will happily ingest Spacelift’s Audit Trail webhook requests! The only catch is that I need to do some additional parsing with Datadog’s log pipelines for it to recognize the source as being from Spacelift - which is a pretty normal thing as you suggested anyway.
      So my initial problem is generally solved, though having additional customization available for the payload body would make this process easier. Being able to add extra fields to the body (or even query parameters?) would enable me to send a payload that Datadog could recognize with properties like source and tags to improve ingestion. This would also be on par with what is possible via the Notification policy webhooks.
      In the meantime, I’ll see if I can put in a PR to add some information to the docs so that others don’t fall into the same trap as I did 😅
      Thanks again for your help, very much appreciated!