abliteration.ai - Uncensored LLM API Platform
Abliteration
PolicyDocsMigrationDefinitionsPricing
Home/Docs/Export Policy Gateway audit logs to Elastic
LLM governance / policy control planeCompliance

Export Policy Gateway audit logs to Elastic

Stream Policy Gateway audit logs into Elastic so security teams can query AI decisions in their SIEM or observability stack.

Exports are available on enterprise plans; contact help@abliteration.ai to enable a log export sink.

Quick start

Example request
{
  "destination": "elastic",
  "dataset": "policy_gateway.audit",
  "namespace": "prod"
}

Service notes

  • Pricing model: Usage-based pricing (~$5 per 1M tokens) billed on total tokens (input + output). See the API pricing page for current plans.
  • Data retention: No prompt/output retention by default. Operational telemetry (token counts, timestamps, error codes) is retained for billing and reliability.
  • Compatibility: OpenAI-style /v1/chat/completions request and response format with a base URL switch.
  • Latency: Depends on model size, prompt length, and load. Streaming reduces time-to-first-token.
  • Throughput: Team plans include priority throughput. Actual throughput varies with demand.
  • Rate limits: Limits vary by plan and load. Handle 429s with backoff and respect any Retry-After header.

What gets exported

Policy Gateway audit logs include consistent decision metadata for compliance reviews.

  • policy_id, decision, effective_decision, reason_code
  • policy_user, project_id, policy_target for audit trails
  • rollout_mode, enforced for rollout tracking
  • triggered_categories, allowlist_hits, denylist_hits
  • model, created_at, and optional data classification tags

Export configuration

Ship audit logs into an Elastic data stream or index for long-term retention.

  • Pick a dataset name such as policy_gateway.audit.
  • Use a dedicated namespace like prod or security.
  • Store audit metadata as nested fields for easy filtering.

Sample Elastic event

Elastic data streams accept structured JSON events.

Sample Elastic event
{
  "data_stream": {
    "type": "logs",
    "dataset": "policy_gateway.audit",
    "namespace": "prod"
  },
  "service": {
    "name": "policy-gateway"
  },
  "event": {
    "dataset": "policy_gateway.audit",
    "action": "rewrite"
  },
  "policy": {
    "policy_id": "support-guardrails",
    "decision": "rewrite",
    "effective_decision": "rewrite",
    "reason_code": "REWRITE",
    "policy_user": "user-12345",
    "project_id": "support-bot",
    "policy_target": "support-bot",
    "rollout_mode": "enforced",
    "enforced": true,
    "triggered_categories": ["self-harm/intent"],
    "allowlist_hits": ["refund policy"],
    "denylist_hits": [],
    "model": "abliterated-model",
    "created_at": "2026-01-16T18:22:11Z"
  }
}

Verification checklist

  • Query the data stream for policy.policy_id and policy.decision.
  • Build Kibana dashboards for decision volume, reason codes, and rollout modes.
  • Alert on spikes in policy.decision values.

Common errors & fixes

  • 401 Unauthorized: Check that your API key is set and sent as a Bearer token.
  • 404 Not Found: Make sure the base URL ends with /v1 and you call /chat/completions.
  • 400 Bad Request: Verify the model id and that messages are an array of { role, content } objects.
  • 429 Rate limit: Back off and retry. Use the Retry-After header for pacing.

Related links

  • Policy Gateway security & privacy
  • Policy gateway backend guide
  • Splunk HEC export
  • Datadog Logs export
  • Amazon S3 export
  • Azure Monitor / Log Analytics export
DefinitionsDocumentationRun in PostmanPrivacy PolicyTerms of ServiceHugging Facehelp@abliteration.ai
FacebookX (Twitter)LinkedIn

© 2025 Social Keyboard, Inc. All rights reserved.