From 372a1824bff034da60a2a5eb65f2c68114cf2152 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Tue, 25 Aug 2026 07:25:43 +0200 Subject: [PATCH] Route gateway audit logs to Loki Post http-log to /workforce instead of /logs. Fluent Bit's http input derives the record tag from the request URI, so the path is what identifies this domain in the collector and becomes the Loki label domain=workforce. The collector keeps writing every domain to the on-disk audit trail as well, so this is reversible by restoring the previous path. Co-Authored-By: Claude Opus 5 --- dev/flux-kustomization.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dev/flux-kustomization.yaml b/dev/flux-kustomization.yaml index 2338d0c..03c6e1e 100644 --- a/dev/flux-kustomization.yaml +++ b/dev/flux-kustomization.yaml @@ -24,7 +24,9 @@ spec: BACKEND_AUDIENCE: '["classic-models-api"]' BACKEND_SCOPES: '[]' API_RATE_LIMIT_MINUTE: "60" - AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs + # The URI path is the collector's routing key: Fluent Bit tags the + # record `workforce` and turns that into the Loki label domain=workforce. + AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/workforce REST_HOSTNAME: workforce-dev.sttlab.local TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker substituteFrom: