Decision Logs

OPA can periodically report decision logs to remote HTTP servers. The decision logs contain events that describe policy queries. Each event includes the policy that was queried, the input to the query, bundle metadata, and other information that enables auditing and offline debugging of policy decisions.

When decision logging is enabled the OPA server will include a decision_id field in API calls that return policy decisions.

See the Configuration Reference for configuration details.

Decision Log Service API

OPA expects the service to expose an API endpoint that will receive decision logs.

  1. POST /logs[/<partition_name>] HTTP/1.1
  2. Content-Encoding: gzip
  3. Content-Type: application/json

The partition name is an optional path segment that can be used to route logs to different backends. If the partition name is not configured on the agent, updates will be sent to /logs.

The message body contains a gzip compressed JSON array. Each array element (event) represents a policy decision returned by OPA.

  1. [
  2. {
  3. "labels": {
  4. "app": "my-example-app",
  5. "id": "1780d507-aea2-45cc-ae50-fa153c8e4a5a",
  6. "version": "v0.11.0"
  7. },
  8. "decision_id": "4ca636c1-55e4-417a-b1d8-4aceb67960d1",
  9. "revision": "W3sibCI6InN5cy9jYXRhbG9nIiwicyI6NDA3MX1d",
  10. "path": "http/example/authz/allow",
  11. "input": {
  12. "method": "GET",
  13. "path": "/salary/bob"
  14. },
  15. "result": "true",
  16. "requested_by": "[::1]:59943",
  17. "timestamp": "2018-01-01T00:00:00.000000Z"
  18. }
  19. ]

Decision log updates contain the following fields:

FieldTypeDescription
[].labelsobjectSet of key-value pairs that uniquely identify the OPA instance.
[].decisionidstringUnique identifier generated for each decision for traceability.
[].revisionstringBundle revision that contained the policy used to produce the decision.
[].pathstringHierarchical policy decision path, e.g., /http/example/authz/allow. Receivers should tolerate slash-prefixed paths.
[].querystringAd-hoc Rego query received by Query API.
[].inputanyInput data provided in the policy query.
[].resultanyPolicy decision returned to the client, e.g., true or false.
[].requested_bystringIdentifier for client that executed policy query, e.g., the client address.
[].timestampstringRFC3999 timestamp of policy decision.
[_].metricsobjectKey-value pairs of performance metrics.