Follow organization audit logs. To stream events from a webhook listener, use
kongctl tail audit-logs listener.
kongctl tail audit-logs
Uses:
kongctl
Related Documentation
Incompatible with
on-prem
Related Resources
Command usage
Usage:
kongctl tail audit-logs [flags]
kongctl tail audit-logs [command]
Aliases:
audit-logs, audit-log
Examples:
# Follow organization audit logs
kongctl tail audit-logs
# Follow as JSON Lines
kongctl tail audit-logs --output jsonl
# Use the webhook listener flow
kongctl tail audit-logs listener --endpoint https://example.test/audit-logs --authorization "Bearer <token>"
Available Commands:
listener Create a webhook destination and stream received events
Flags:
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 3024_day, 3024_night, aardvark_blue, abernathy ]
- Reference : [ https://github.com/lrstanley/bubbletint/blob/master/DEFAULT_TINTS.md ] (default "auto")
--columns stringArray Select text columns as HEADER=.field (repeatable or comma-separated).
Supports nested fields, quoted keys, array indexes, and string slices.
--config-file string Path to the configuration file to load.
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
--end-time string Inclusive RFC3339 upper bound for event timestamps.
Accepts UTC (Z) or a numeric UTC offset.
- UTC example : [ 2026-08-24T14:00:00Z ]
- Offset example: [ 2026-08-24T09:00:00-05:00 ]
-F, --follow Poll continuously for new events until interrupted. (default true)
-h, --help help for audit-logs
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--limit int Maximum total events to return.
Defaults to 50 when no time window is specified.
Time-window queries are unlimited unless --limit is specified.
Set to 0 for unlimited.
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text|jsonl ] (default "text")
--page-size int Maximum audit-log records requested per API page (1..1000).
- Config path: [ konnect.page-size ] (default 100)
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
- Config path: [ konnect.pat ]
--poll-interval duration Interval between successful polling cycles in follow mode. (default 10s)
-p, --profile string Specify the profile to use for this command. (default "default")
--region string Konnect region identifier (for example "eu").
- Config path: [ konnect.region ]
--since duration Retrieve events from the specified lookback period.
- Examples: [ 30s, 15m, 2h, 24h, 168h, 1h30m ]
--start-time string Inclusive RFC3339 lower bound for event timestamps.
Accepts UTC (Z) or a numeric UTC offset.
- UTC example : [ 2026-08-23T14:00:00Z ]
- Offset example: [ 2026-08-23T09:00:00-05:00 ]
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]
--type string Filter by event type: authentication, authorization, or gateway_access.
Use "kongctl tail audit-logs [command] --help" for more information about a command.
kongctl tail audit-logs listener
Run the original webhook-based tail flow: create a destination, configure the regional webhook, and stream records received by a local listener.
Usage:
kongctl tail audit-logs listener [flags]
Flags:
--authorization string Value for the Authorization header Konnect includes when sending audit logs. The local listener validates this value on every incoming request.
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 3024_day, 3024_night, aardvark_blue, abernathy ]
- Reference : [ https://github.com/lrstanley/bubbletint/blob/master/DEFAULT_TINTS.md ] (default "auto")
--config-file string Path to the configuration file to load.
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
--configure-webhook Automatically bind and enable the organization webhook with the created destination. (default true)
-d, --detach Run listener in background as a detached kongctl process (not compatible with --tail).
--endpoint string Explicit destination endpoint URL used for Konnect destination creation.
-h, --help help for listener
--jq string Filter streamed JSON records using a jq expression (only used with --tail).
--listen-address string HTTP listen address for incoming audit-log webhooks. (default "127.0.0.1:19090")
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-format string Audit-log payload format. Allowed: cef|json|cps. (default "json")
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
--max-body-bytes int Maximum accepted request body size in bytes. (default 1048576)
--name string Destination name. Default: kongctl-<hostname>-<pid>.
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text ] (default "text")
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
- Config path: [ konnect.pat ]
--path string HTTP path that accepts webhook requests. (default "/audit-logs")
-p, --profile string Specify the profile to use for this command. (default "default")
--public-url string Externally reachable base URL for this listener; used to build destination endpoint when --endpoint is omitted.
--region string Konnect region identifier (for example "eu").
- Config path: [ konnect.region ]
--skip-ssl-verification Skip TLS certificate verification for destination delivery.
--tail Stream received audit-log records to stdout. (default true)
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]