feat: filter by user uid #26
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When a user is requesting their own audit logs using a user scoped query the system should be searching audit logs by the user's UID instead of the username because username can change over time. This change introduces a new projection that takes advantage of a new `user_uid` field that was introduced in the table schema to support performant queries that filter for a specific user ID. I've also adjusted the projections to use the same hourly bucketing approach used on the main table to see if we can get some additional performance benefits.
This change allows users to filter audit log results by a user's UID with the `user.uid` field.
The `requestReceivedTimestamp` indicates when the request was received by the apiserver. This timestamp is what we should use as the audit log timestamp since it indicates when the request was made by the client. The `stageTimestamp` indicates when the stage of the request generated the audit log entry which happens after the request is received. We still use the `stageTimestamp` to measure delays in the collection pipeline so we know how long it takes for a record to be collected from the apiserver and sent to Clickhouse.
scotwells
requested review from
JoseSzycho,
OscarLlamas6,
cc-datum,
drewr,
ecv and
zachsmith1
ecv
approved these changes
Jan 15, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR makes additional improvements to platform-wide querying performance, adjusts the clickhouse audit log schema to use the correct timestamp for the request, adds support for querying by the user's UID, and adjusts the user-scoped projection to use the user's UID value instead of the username.
Details
.requestReceivedTimestampfield of the audit log to represent the audit log's timestamp since it's the timestamp when the request was received by the apiserver. The.stageTimestampis used by the collection pipeline to calculate delays in the pipeline because the timestamp indicates when the audit log was generated by the apiserver.Relates to datum-cloud/enhancements#536