search

sourcegraph / sourcegraph-public-snapshot

Code AI platform with Code Search & Cody
https://sourcegraph.com
Other
10.1k stars 1.27k forks source link

Output user event log to Splunk #40376

Open mike-r-mclaughlin opened 2 years ago

mike-r-mclaughlin commented 2 years ago

Feature request description

Allow administrators to configure Sourcegraph to optionally send the user event logs (/users/<username>/settings/event-log) to Splunk

Is your feature request related to a problem? If so, please describe.

Admins would like to search and report on user activity

Describe alternatives you've considered.

Write a script to pull the data from Sourcegraph via the query UserEventLogs API and push to Splunk.

Additional context

Requested by: https://github.com/sourcegraph/accounts/issues/6716 via Slack

oacnhpkqxjhufwumkkqnshvlmheokqv commented 1 year ago

Hey @mike-r-mclaughlin how do we get some motion on this one?

To clarify, we ship all container logs to Splunk, so just outputting this data to the container logs would be great.

Event data that would be super valuable to have:

  1. User's email address
  2. User action (run a search, click a button, scroll down search results list to load streaming search result details, etc.)
  3. User client (web UI, IDE extension, browser extension, custom API client, and details on which browser / IDE, version, extension version)
  4. URL that the user took the action on (for new connections, this may be blank or the referrer)
  5. URL that the user action took them to (or tried to take them to)
  6. HTTP response code (200, 403, 404, 504, etc.,)
  7. Reason for failures, like repo doesn’t exist or file doesn’t exist in repo for 404s, repo exists but the user doesn’t have access to it for 403s, frontend timed out waiting for backend to return API request for 504, with a useful amount of detail
  8. Duration the user had to wait between initiating the action and the getting the complete results

There's this RFE, but building a whole analytical interface is probably a much bigger ask than just outputting the events via container logs so customers can use their existing analytics infrastructure.