How can I stream the admin audit logs to Sumologic?

[alamm]

Hi,

I am looking to stream the admin audit logs (the ones that are shown in UI) to Sumologic. When I used curl to query the manage API for audit logs, I can blank responses. Even if I do specific products, its blank. I want to be able to just stream it for my org.

➜ curl -X GET --header "Content-Type: application/octet-stream" --header "Authorization: Basic <some-key>" "https://api.enterprise.apigee.com/v1/audits/o/<my-org>/apiproducts?expand=true"

{

"auditRecord" : [ ]

}%

[dchiesa1]

There is no builtin mechanism within Apigee Edge to "stream" the audit logs to a different sink .

You could of course poll the audit logs and when you get updated records, post them to sumologic. That requires a cron job or something similar.

For example, every 10 minutes, query the audit log and query the records for the past hour. You'd need to track the most recently received Audit record by timestamp, and then filter out any audit records in the response that have already been seen. Then write the remaining records to sumo.