Detailed log schema?

I don’t suppose there’s a reference/schema list for the various kinds of logs/events? With the limited availability of logs as far as how long they are kept, creating some sort of logging backend is a must, but it would be extremely helpful to know what that data looks like so we can model it on our end. Sure, we look in logs ourselves, catalog it, etc, but if it’s done already… yeah, that would be nice.

There’s no documentation around it at the moment. While there are efforts to move towards the Cloud Events standard, it’s not there yet. So, at the moment, there’s no schema doc available, but I’ve taken that request internal to make our product team aware of it / the demand for it.

1 Like

Has there been any movement on this in the past year? I’ve also noticed that the schema changes depending on the sink (custom webhook vs. fetching via management api [ie. /api/v2/logs).

following up on this again. this would be very nice to have.

For now, I’ve searched Monitoring → Logs → type:..., and looked at the examples there to write my own schema based on the data.

@mathiasconradt Any update on this? I’ve been tasked with ingesting the log events and parsing them into some tables in Snowflake. Documentation about the schema would be super helpful!

I’ll second the request for an explicit log schema. We are planning to use log streaming to a custom webhook to back-fill our current on-premise authentication event history as we move to Auth0. The responses may be fairly self-descriptive but an explicit schema would be much preferred over deducing /reverse engineering the semantics of it ourselves.

1 Like

Following up on this thread.
We recently published an official log schema.
You can find more information here - Auth0 Changelog