Exporting Audit Logs or Alert Jobs

In Lytics, audit logs and system alerts originate from a shared source: Lytics System Events. A System Event is a log of an action taken within the platform, whether it’s a user creating a job, segment, or role, or an error message indicating a job failure.

Export vs. Alert

• Log Export: This is a job that either streams logs in real time or performs a batch export to an external source, such as a webhook or a data warehouse table.
• Log Alert: Alerts are triggered based on specified conditions and notify users when certain actions occur within the system.

In both cases, the content of exports or alerts depends on the filters you set up. Filtering is typically done using the Subject (such as User, Segment, or Job) and the Verb (the action taken on the subject, like created, updated, deleted, or failed).

Creating a job to export your Audit and System Event logs works like creating any other job; for more information, see Data Pipeline > Jobs. In the Filters panel, select Audit Logs to create an export of your Audit logs or System Events.

Click to enlarge

Depending on your provider, you can then choose to export System Events.

For example, suppose you selected Google Cloud and want to export the events to BigQuery.

Click to enlarge

Select the BigQuery: Export System Events job type tile. After you choose the job type, configure it like any other export job. For BigQuery, you can run a one-time or continuous export.

Creating a job to alert on Audit and System Event logs works like creating any other job; for more information, see Data Pipeline > Jobs. In the Filters panel, select Audit Logs to create an export of your Audit logs or System Events.

Click to enlarge

Depending on your provider, you can then choose to export System Events or Email Alerts.

Click to enlarge

For example, to get an email when an alert is triggered, select Lytics as your provider and then select Email Alerts.

Then configure which Subject to listen to and which Event Types (aka Verbs).

Click to enlarge

Audit logs can be filtered by:

• Subject Type: What the event is about, such as work, workflow, user, or campaign. See the list of subject types below.
• Subject ID: The identifier of a subject, such as a work ID, workflow ID, or campaign ID.
• Verb: The action the event describes, performed on a subject. See the list of available verbs below.

You can observe job-status events by creating a webhook subscription that POSTs data (or JSON) to a specific URL. Like email alerts and reports, these updates can be consumed downstream for your monitoring use cases. Common examples include listening for audience exports being created, updated, or deleted, and getting notified whenever a batch import or export for a given integration fails.

Work related filters

For events related to the subject type work, the following verbs may be emitted:

• synccomplete - Emitted when a sync operation is completed.
• updated - Emitted when the job configuration is modified.
• created - Emitted when a new job is created.
• deleted - Emitted when a job is terminated.
• synced - Emitted when the job sync operation completes.
• completed - Emitted when a job has finished successfully.
• started - Emitted when a job begins execution.
• failed - Emitted when a job encounters an error.
• syncing - Emitted while a job is actively syncing.

Overview

Lytics provides a webhook integration that lets you monitor and react to system events in real time. With this integration, you can build automated workflows, trigger external actions, and keep your other systems in sync based on events that occur in Lytics.

Configuration Examples

Basic Webhook Setup

The following example shows how to subscribe to multiple event types and send them to a webhook endpoint:

{
    "config": {
        "system_event_multiple_types": ["updated", "created", "failed"],
        "webhook_url": "YOUR_WEBHOOK_ENDPOINT",
        "headers": {
            "custom-header": "header-value"
        }
    },
    "workflow": "webhook_system_events"
}

Slack Integration

You can integrate Lytics system events with Slack using a custom JSON template. This example shows how to send failure notifications to a Slack channel:

{
    "config": {
        "system_event_type": "failed",
        "webhook_url": "YOUR_SLACK_WEBHOOK_URL",
        "json_template": "local note = if std.objectHas(event.data, \"notes\") then event.data.notes else \"A work failed\"; {\"text\": \"Alert notification: \" + note + \". For more info go to: https://app.lytics.com/conductor/pipeline/jobs/%s?aid=%s\" % [event.data.subject_id, event.data.aid] }"
    },
    "workflow": "webhook_system_events"
}

Advanced Filtering

You can filter events by source type and ID using the system_event_sources configuration:

Filter by Specific IDs

{
    "config": {
        "system_event_multiple_types": ["updated", "created", "failed"],
        "system_event_sources": {
            "work": [
                "work-id-1",
                "work-id-2"
            ]
        },
        "webhook_url": "YOUR_WEBHOOK_ENDPOINT",
        "headers": {
            "custom-header": "header-value"
        }
    },
    "workflow": "webhook_system_events"
}

Monitor All Events of a specific Verb Type

To receive events for all works in your account, use an empty array.

{
    "config": {
        "system_event_multiple_types": ["updated", "created", "failed"],
        "system_event_sources": {
            "work": []
        },
        "webhook_url": "YOUR_WEBHOOK_ENDPOINT",
        "headers": {
            "custom-header": "header-value"
        }
    },
    "workflow": "webhook_system_events"
}

Best Practices

1. Ensure your webhook endpoint can handle the expected volume of events.
2. Implement proper error handling and retry logic in your webhook receiver.
3. Use HTTPS endpoints for secure data transmission.
4. Monitor webhook delivery success rates and implement appropriate alerting.

Support

For additional help or questions about the webhook integration, contact Lytics Support or see the Lytics API documentation.