Customize log message

Workato lets you customize the audit log message before streaming it to your choice of security and event management applications like S3, Splunk, Datadog, and more. This allows you to send it in a certain format or customize the event message to suit your needs. For example, you may need to include the source application (for example, Workato) and environment metadata (such as staging or production) so that the event logs are automatically processed in the destination application.

In the Account Settings > Debug tab, you can create the custom log message using JSON format in the Audit log streaming > Customize log message section. Along with your custom fields, define the JSON structure with a placeholder for the Workato audit log. Workato replaces the placeholder value with the actual log message before the event is streamed.

Supported placeholders

Workato supports the following placeholders:

Placeholder	Description	Example
{{{log_message}}}	Audit log event message as JSON	See examples
{{{log_message_str}}}	Audit log event message as an escaped JSON string. Required for logs sent to Grafana Loki.	See example
{{{now}}}	Timestamp	2023-06-02T01:30:01.002-04:00
{{{now_utc}}}	Timestamp in milliseconds	1685683801002.2139
{{{now_utc_micro}}}	Timestamp in microseconds	1685683801002213
{{{now_utc_nano}}}	Timestamp in nanoseconds	1685683801002214000

JSON KEYS

Currently, if you're using the placeholders in a JSON object, each key must match the name of the placeholder in the value. For example, if you use the placeholder {{{log_message_str}}}, you must give it the key "log_message_str":

{
	"log_message_str": {{{log_message_str}}},
	"now_utc_micro": {{{now_utc_micro}}}
}

Example custom log message

In the following example, we send the source, environment, and service fields to Datadog so that the message is automatically routed and stored in the correct bucket.

The {{{log_message}}} is the placeholder that Workato uses to substitute the actual audit log event message in JSON format.

{
  "source": "workato",
  "environment": "staging",
  "hostname": "workato_cloud",
  "service": "emp_onboarding",
  "log_message": {{{log_message}}}
}

VALID JSON REQUIRED

Make sure you define valid JSON. If the JSON is invalid or does not contain either the {{{log_message}}} or {{{log_message_str}}} placeholder, then Workato will send the default log message without any customization.

The following images show what the log message looks like in the Datadog log explorer.

Custom audit log message fields

Custom recipe started activity audit log message

Custom job history audit log message

Example custom log message for Grafana Loki

The Grafana Loki HTTP API (opens new window) requires the log message to be sent as a string, so you must use the {{{log_message_str}}} placeholder instead of {{{log_message}}}.

The Loki API also expects a nanosecond timestamp formatted as a string. Use the "{{{now_utc_nano}}}" placeholder surrounded by double quotes to ensure the timestamp is converted to a string.

Format the JSON structure for the custom audit log message as follows:

{
  "streams": [
    {
      "stream": {
        "label": "workato"
      },
      "values": [
          ["{{{now_utc_nano}}}", {{{log_message_str}}}]
      ]
    }
  ]
}

Example custom log message sent to Loki:

{
	"streams": [
		{
			"stream": {
				"label": "workato"
			},
			"values": [
				[
					"1685687453790827508",
					"{\"event\":\"recipe_started\",\"details\":{\"run_once\":false,\"request\":{\"ip_address\":\"76.100.203.123\",\"user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36\"}},\"user\":{\"id\":1234567,\"external_id\":null,\"email\":\"example.user@workato.com\",\"name\":\"Example User\",\"environment_id\":1234567,\"environment_type\":\"dev\",\"account_id\":1234567,\"account_name\":\"Example User\"},\"team\":{\"id\":1234567,\"external_id\":null,\"email\":\"example.user@workato.com\",\"name\":\"Example User's team\",\"environment_id\":1234567,\"environment_type\":\"dev\",\"account_id\":1234567,\"account_name\":\"Example User\"},\"resource\":{\"type\":\"Flow\",\"id\":16983123,\"name\":\"Cat Fact Generator\",\"path\":\"Home/AI Testing\",\"folder_id\":9020123},\"timestamp\":\"2023-06-02 06:30:53 UTC\"}"
				]
			]
		}
	]
}