Exporting Teleport Audit Events
The Teleport Auth Service emits audit logs when users and services interact with your cluster.
You can use Teleport's Event Handler plugin to export audit events from Teleport so you can store them in a log management platform or custom backend.
Getting started
The first step is to set up the Event Handler plugin with your Teleport cluster. We will generate the credentials needed for the Event Handler to authenticate to the Teleport Auth Service and access the events API.
Integrations
If you are new to exporting audit events with Teleport, read Forwarding Events with Fluentd to learn the basics of how our Event Handler plugin works. While this guide focuses on Fluentd, the Event Handler plugin can export audit events to any endpoint that ingests JSON messages via HTTP.
Next, read our guides to setting up the Event Handler plugin to export audit events to your solution of choice:
- Export Teleport Audit Events with the Elastic Stack: How to configure the Event Handler plugin to forward Teleport audit logs to Logstash for ingestion in Elasticsearch so you can explore them in Kibana.
- Export Teleport Audit Events with Panther: How to configure the Event Handler plugin to send logs to Panther via Fluentd so you can explore your audit events in Panther.
- Export Teleport Audit Events with Splunk: How to configure the Event Handler plugin to send logs to Splunk's Universal Forwarder so you can explore your audit events in Splunk.
- Export Teleport Audit Events with Datadog: How to configure the Event Handler plugin to export audit logs to Datadog via Fluentd.