Connect Axiom with Unkey

Stream Unkey workspace audit logs to an Axiom dataset with an Axiom log drain.

Unkey provides infrastructure for building and operating APIs. Connect Unkey with Axiom to stream structured workspace audit logs into an Axiom dataset.

Prerequisites

Create an Axiom account.
Create a dataset in Axiom where you send your data.
Create an API token in Axiom with permissions to ingest data to the dataset you have created.

Create an Unkey account.

Set up an Axiom log drain

Create the log drain in your Unkey workspace:

In the Unkey dashboard, select your workspace, and then go to Settings > Log Drains.
Click Create Log Drain.
Select Axiom as the destination.
Enter a descriptive name for the log drain.
Enter the name of your Axiom dataset and your Axiom API token.
Select New audit logs to send future events, or select All retained audit logs to include the history available under your workspace's audit log retention.
Click Create Log Drain.

Unkey sends audit logs asynchronously in batches. Events can take several minutes to appear in Axiom.

Each Axiom row contains _time, a stream value of audit_logs, and the audit log payload in event. Log drains provide at-least-once delivery, so use event.id to identify duplicate events.

For delivery behavior, retries, and troubleshooting, see the Unkey log drain documentation.

Explore your Unkey audit logs

After you create the log drain, open the Stream tab in Axiom to verify that events arrive in your dataset. Unkey audit log rows include the following fields:

_time: Time when the action occurred
stream: Unkey log stream, with the value audit_logs
['event.id']: Unique event identifier for deduplication
['event.action']: Action that produced the event, such as key.create
['event.occurred_at']: Time when the action occurred
['event.actor.type']: Type of actor, such as user, rootkey, or system
['event.actor.id']: Identifier of the actor
['event.actor.name']: Display name of the actor, when available
['event.actor.metadata']: Additional actor attributes, when available
['event.targets']: Resources affected by the action. Each target contains:
- id: Identifier of the resource
- type: Type of resource, such as api or key
- name: Display name of the resource
- metadata: Additional resource attributes, when available
['event.context.location']: IP address associated with the action
['event.context.user_agent']: User agent associated with the action
['event.metadata']: Additional event attributes, when available
['event.description']: Human-readable summary of the action
['event.correlation_id']: Identifier that groups related events, when available

For the complete list of actions, see Unkey audit log event types.