Bindplane Audit Logs

The Bindplane Audit Logs source collects audit logs from a single Bindplane instance. Audit logs record user authentication, resource operations, configuration management, rollout behavior, and other system activity. The collector polls Bindplane on a fixed interval and converts each audit record into an OpenTelemetry log. Each source instance collects audit logs for one project. For a classic API key this would be the project it belongs to. For scoped API keys this is configured by setting the Project ID.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

You need a reachable Bindplane instance and an API key for the project whose audit logs you want to collect.

• API key.

  • (Recommended) A scoped API key with the Bindplane Telemetry read permission for the target project. Set Project ID to that project's ID. See Scoped API Keys.
  • A classic API key, created from the Project Settings page by a user with admin privileges. Audit logs are limited to the key's project. See API Keys.
• Cloud. For a Bindplane Cloud instance, no host details are required. The source connects to https://app.bindplane.com.
• Self-Hosted. For a self-hosted instance, the collector must be able to reach the Bindplane host URL and port (default port 3001). If the instance terminates TLS, provide the appropriate TLS settings under the Configuration section.

Configuration

Logs

Parameter	Type	Required	Default	Description
Host Type	Enum: Cloud, Self-Hosted	No	Cloud	Whether to connect to a Bindplane Cloud instance or a Self-Hosted instance.
Bindplane API Key	String	Yes	(empty)	A classic API key, or a scoped API key with the Bindplane Telemetry read permission. Stored as a sensitive value.
Project ID	String	Only when using a scoped API key	(empty)	The ID of the project to collect audit logs from. Pick one of your projects or enter any project ID. Required when using a scoped API key. Sent as the X-Bindplane-Account-ID header.
Bindplane Host Scheme	Enum: https, http	No	https	The protocol scheme used to reach the instance. Shown when Host Type is Self-Hosted.
Bindplane Host URL	String	Yes	(empty)	The host URL of the Bindplane instance to collect audit logs from. Shown when Host Type is Self-Hosted.
Bindplane Host Port	String	No	3001	The port of the Bindplane instance to collect audit logs from. Shown when Host Type is Self-Hosted.

TLS (Self-Hosted)

These parameters apply when Host Type is Self-Hosted.

Parameter	Type	Required	Default	Description
Enable TLS	Boolean	No	true	Configure advanced TLS settings for the connection to the instance.
Skip TLS Certificate Verification	Boolean	No	false	Skip TLS certificate verification. Shown when Enable TLS is true.
TLS Certificate Authority File	String	No	(empty)	Certificate authority used to validate TLS certificates. Shown when Enable TLS is true and certificate verification is not skipped.
Server Name Override	String	No	(empty)	Optional virtual hostname indicating the name of the server requested by the client. Generally not required. Shown when Enable TLS is true.
Mutual TLS	Boolean	No	false	Use mutual TLS authentication. Shown when Enable TLS is true.
TLS Client Certificate File	String	No	(empty)	A TLS certificate used for client authentication. Shown when Enable TLS and Mutual TLS are true.
TLS Client Private Key File	String	No	(empty)	A TLS private key used for client authentication. Shown when Enable TLS and Mutual TLS are true.

Advanced

Parameter	Type	Required	Default	Description
Poll Interval	Duration	No	10s	The interval to poll Bindplane for audit logs. Must be at least 10 seconds.
Parse Attributes	Boolean	No	false	Parse audit log fields into individual log record attributes. When false, the body is the raw log message. Requires a collector with the bindplaneauditlogs receiver at v1.92.0 or later.

Examples

Collect audit logs from a Bindplane Cloud instance

This is the minimal configuration. It connects to https://app.bindplane.com and polls every 10 seconds using the provided API key.

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Cloud
    - name: bindplane_api_key
      value: <your-scoped-api-key>
    - name: bindplane_project_id
      value: <your-project-id>

Collect audit logs from a Self-Hosted instance over TLS

Reaches a self-hosted instance at https://bindplane.internal:3001, validates the server certificate with a CA file, and parses audit fields into attributes.

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Self-Hosted
    - name: bindplane_api_key
      value: <your-scoped-api-key>
    - name: bindplane_project_id
      value: <your-project-id>
    - name: bindplane_host_scheme
      value: https
    - name: bindplane_host_url
      value: bindplane.internal
    - name: bindplane_host_port
      value: "3001"
    - name: enable_tls
      value: true
    - name: ca_file
      value: /opt/tls/ca.crt
    - name: parse_attributes
      value: true

Configuration Tips

• A classic API key determines which project's audit logs are collected. With a scoped API key, Project ID does. To collect audit logs from multiple projects, add one source instance per project.
• Set Poll Interval no lower than 10s. Values below the minimum are rejected.
• Leave Parse Attributes off if you prefer to parse the raw body downstream, or turn it on to get structured attributes directly from the receiver. It requires a collector with the receiver at v1.92.0 or later.

Troubleshooting

No audit logs are collected

Symptoms: the source connects but no log records arrive.

Solutions:

1. Confirm the API key is valid and unexpired. A classic key must belong to an admin user in the target project.
2. For a scoped API key, confirm Project ID is set and the key has the Bindplane Telemetry read permission for that project.
3. Confirm audit activity has occurred in the project since the source started.

Authentication or connection errors (Self-Hosted)

Symptoms: the collector reports connection refused, timeout, or TLS handshake errors.

Solutions:

1. Verify the Host URL, Host Scheme, and Host Port match the instance. The default port is 3001.
2. If the instance uses a private or self-signed certificate, supply the CA file, or enable Skip TLS Certificate Verification for testing only.

Parse Attributes has no effect

Symptoms: the log body remains the raw message even though Parse Attributes is enabled.

Solutions:

1. Confirm the collector includes the bindplaneauditlogs receiver at v1.92.0 or later. Earlier versions ignore this option.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: bindplane-audit-logs
spec:
  type: bindplane_audit_logs
  parameters:
    - name: host_type
      value: Self-Hosted
    - name: bindplane_api_key
      value: <your-scoped-api-key>
    - name: bindplane_project_id
      value: <your-project-id>
    - name: bindplane_host_scheme
      value: https
    - name: bindplane_host_url
      value: bindplane.internal
    - name: bindplane_host_port
      value: "3001"
    - name: enable_tls
      value: true
    - name: insecure_skip_verify
      value: false
    - name: ca_file
      value: /opt/tls/ca.crt
    - name: poll_interval
      value: 10s
    - name: parse_attributes
      value: false

Related Resources

• Bindplane Audit Logs receiver
• API Keys
• Scoped API Keys