Event Streaming

​

Overview

• OpenTelemetry (OTLP). Each event is sent as an OpenTelemetry log record over OTLP/HTTP. This works with Datadog, PostHog, Grafana Loki, Grafana Cloud, New Relic, Honeycomb, Dynatrace, Elastic, SigNoz, Axiom, Better Stack, and any other backend that accepts OTLP logs. No collector or agent is needed in between.
• Raw JSON. The audit event is posted as-is to any webhook URL. Point it at a flow inside Activepieces and route each event to Slack, Gmail, Microsoft Teams, custom HTTP, and so on.

​

Quick start

1. Open Platform Admin → Security → Audit Logs → Event Streaming and click New Destination.
2. Destination — pick Send to an OpenTelemetry tool or Send to a webhook. This choice sets the format, and you cannot change it once the destination is created.
3. Events — select the events to send.
4. Connection — paste the endpoint URL and add any headers the endpoint needs, such as an API key. For an OpenTelemetry tool, also pick the encoding. For a webhook, you can click Generate handler flow instead of pasting a URL, and Activepieces builds a flow to handle the events (see below). Use Send test event to fire a sample of any selected event.
5. Click Create destination.

​

Generate a handler flow

​

Formats

​

OpenTelemetry

• Protobuf (recommended) — Content-Type: application/x-protobuf. This is the OTLP default and works with every backend listed below. Datadog, Dynatrace, and Elastic document only this encoding.
• JSON — Content-Type: application/json, the OTLP/JSON encoding. Pick it only when your receiver accepts JSON and not protobuf.

{
  "resourceLogs": [{
    "resource": { "attributes": [{ "key": "service.name", "value": { "stringValue": "activepieces" } }] },
    "scopeLogs": [{
      "scope": { "name": "activepieces.event-streaming" },
      "logRecords": [{
        "timeUnixNano": "1790158542318000000",
        "severityNumber": 9,
        "severityText": "INFO",
        "eventName": "flow.run.finished",
        "body": { "stringValue": "{\"id\":\"Qz3vN8kLp2XwR7tY1mB4c\",\"action\":\"flow.run.finished\",\"data\":{...}}" },
        "attributes": [
          { "key": "action", "value": { "stringValue": "flow.run.finished" } },
          { "key": "platformId", "value": { "stringValue": "Hd8sK2mWq9LxT4vB7nP1e" } },
          { "key": "projectDisplayName", "value": { "stringValue": "Finance Ops" } },
          { "key": "data.flowRun.duration", "value": { "intValue": "5214" } },
          { "key": "data.flowRun.flowDisplayName", "value": { "stringValue": "Invoice sync" } },
          { "key": "data.flowRun.status", "value": { "stringValue": "FAILED" } }
        ]
      }]
    }]
  }]
}

​

OpenTelemetry endpoints

​

Raw JSON

• action — the event name (for example flow.run.finished).
• data — event-specific payload, including details like the flow id, run id, status, or affected user.
• id, created, updated — event identifiers and timestamps.
• platformId, projectId — context fields present on every event.
• userId, userEmail, ip — who did it and from where. These are filled in for events that come from a user request. The four flow.run.* events are emitted by a worker rather than a request, so they carry none of them.

​

Headers

• Leave a value empty to keep the stored value.
• Type a new value to replace it.
• Delete the whole row to remove the header.

​

Test, enable, and disable

​

Available events

​

Requirements

• Enterprise Edition: Event Streaming requires a plan with Event Streaming enabled. Without it, no events are delivered.
• Platform admin: only platform admins can configure destinations.
• HTTPS endpoint: use HTTPS for any external endpoint. Audit events carry user emails and IP addresses, and Activepieces does not reject an http:// URL for you.
• Publicly accessible: external endpoints must be reachable from your Activepieces server. Handler flows on this same instance are delivered internally, so they work even when the instance is not publicly reachable (for example, behind an internal load balancer).

​

Troubleshooting

• Events not received: check the destination is enabled. For external endpoints, verify they are reachable from your server and return 2xx status codes. For a handler flow on this instance, make sure the flow is published and enabled.
• 404 from an OpenTelemetry backend: the URL is missing the logs path. Paste the full logs URL from the table above, not the base URL.
• 415 or a decode error from an OpenTelemetry backend: the backend does not accept the selected encoding. Switch the encoding to Protobuf.
• Test fails: check that your URL is valid and uses HTTPS. The test reports the status code returned by the endpoint, which usually names the problem.
• Missing events: make sure the event type is selected in your destination configuration.
• A field is missing: the field is not on that event. The four flow.run.* events carry no userId, userEmail, or ip, because a worker emits them rather than a user request.

​

See also

• Audit Logs — view every event recorded on your platform