GitLab Integration


Version	3.1.0 (View all)
Subscription level What's this?	Basic
Developed by What's this?	Elastic
Ingestion method(s)	File
Minimum Kibana version(s)	9.0.0 8.13.0

This integration is for ingesting logs from GitLab.

api: Collect logs for HTTP requests made to the GitLab API
application: Collect logs for events in GitLab like user creation or project deletion.
audit: Collect logs for changes to group or project settings and memberships.
auth: Collect logs for protected paths abusive requests or requests over the Rate Limit.
pages: Collect logs for Pages.
production: Collect logs for Rails controller requests received from GitLab.
sidekiq: Collect logs from sidekiq for jobs background jobs that take a long time.

See the GitLab Log system docs for more information.

Compatibility

The GitLab module has been developed with and tested against the community edition version 18.9.2-ce.0.

Requirements

Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions.

Setup

Refer to the GitLab documentation for the specific filepath(s) for your instance type. Both are provided as default in the configuration setup, but only one will be needed for use.

Logs

api

Collect logs for HTTP requests made to the GitLab API. Check out the GitLab API log docs for more information.

Field	Description	Type
@timestamp	Event timestamp.	date
cloud.image.id	Image ID for the cloud instance.	keyword
data_stream.dataset	Data stream dataset name.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset	constant_keyword
event.module	Event module	constant_keyword
gitlab.api.api_error		flattened
gitlab.api.content_length		long
gitlab.api.correlation_id		keyword
gitlab.api.cpu_s		long
gitlab.api.db		double
gitlab.api.db_cached_count		long
gitlab.api.db_ci_cached_count		long
gitlab.api.db_ci_count		long
gitlab.api.db_ci_duration_s		float
gitlab.api.db_ci_replica_cached_count		long
gitlab.api.db_ci_replica_count		long
gitlab.api.db_ci_replica_duration_s		float
gitlab.api.db_ci_replica_txn_count		long
gitlab.api.db_ci_replica_txn_duration_s		float
gitlab.api.db_ci_replica_txn_max_duration_s		double
gitlab.api.db_ci_replica_wal_cached_count		long
gitlab.api.db_ci_replica_wal_count		long
gitlab.api.db_ci_replica_write_count		long
gitlab.api.db_ci_txn_count		long
gitlab.api.db_ci_txn_duration_s		float
gitlab.api.db_ci_txn_max_duration_s		double
gitlab.api.db_ci_wal_cached_count		long
gitlab.api.db_ci_wal_count		long
gitlab.api.db_ci_write_count		long
gitlab.api.db_count		long
gitlab.api.db_duration_s		float
gitlab.api.db_main_cached_count		long
gitlab.api.db_main_count		long
gitlab.api.db_main_duration_s		float
gitlab.api.db_main_replica_cached_count		long
gitlab.api.db_main_replica_count		long
gitlab.api.db_main_replica_duration_s		float
gitlab.api.db_main_replica_txn_count		long
gitlab.api.db_main_replica_txn_duration_s		float
gitlab.api.db_main_replica_txn_max_duration_s		double
gitlab.api.db_main_replica_wal_cached_count		long
gitlab.api.db_main_replica_wal_count		long
gitlab.api.db_main_replica_write_count		long
gitlab.api.db_main_txn_count		long
gitlab.api.db_main_txn_duration_s		float
gitlab.api.db_main_txn_max_duration_s		double
gitlab.api.db_main_wal_cached_count		long
gitlab.api.db_main_wal_count		long
gitlab.api.db_main_write_count		long
gitlab.api.db_primary_cached_count		long
gitlab.api.db_primary_count		long
gitlab.api.db_primary_duration_s		float
gitlab.api.db_primary_txn_count		long
gitlab.api.db_primary_txn_duration_s		float
gitlab.api.db_primary_txn_max_duration_s		double
gitlab.api.db_primary_wal_cached_count		long
gitlab.api.db_primary_wal_count		long
gitlab.api.db_primary_write_count		long
gitlab.api.db_replica_cached_count		long
gitlab.api.db_replica_count		long
gitlab.api.db_replica_duration_s		float
gitlab.api.db_replica_txn_count		long
gitlab.api.db_replica_txn_duration_s		float
gitlab.api.db_replica_txn_max_duration_s		double
gitlab.api.db_replica_wal_cached_count		long
gitlab.api.db_replica_wal_count		long
gitlab.api.db_replica_write_count		long
gitlab.api.db_txn_count		long
gitlab.api.db_write_count		long
gitlab.api.duration		float
gitlab.api.duration_s		float
gitlab.api.exclusive_lock_hold_duration_s		double
gitlab.api.exclusive_lock_requested_count		long
gitlab.api.exclusive_lock_wait_duration_s		double
gitlab.api.gitaly_calls		long
gitlab.api.gitaly_duration		float
gitlab.api.gitaly_duration_s		double
gitlab.api.host		keyword
gitlab.api.mem_bytes		long
gitlab.api.mem_mallocs		long
gitlab.api.mem_objects		long
gitlab.api.mem_total_bytes		long
gitlab.api.meta.caller_id		keyword
gitlab.api.meta.client_id		keyword
gitlab.api.meta.feature_category		keyword
gitlab.api.meta.gl_user_id		keyword
gitlab.api.meta.organization_id		keyword
gitlab.api.meta.project		keyword
gitlab.api.meta.remote_ip		ip
gitlab.api.meta.root_namespace		keyword
gitlab.api.meta.user		keyword
gitlab.api.meta.user_id		long
gitlab.api.params.action		keyword
gitlab.api.params.changes		keyword
gitlab.api.params.info.architecture		keyword
gitlab.api.params.info.executor		keyword
gitlab.api.params.info.features.raw_variables		keyword
gitlab.api.params.info.features.service_variables		keyword
gitlab.api.params.info.features.trace_checksum		keyword
gitlab.api.params.info.features.trace_reset		keyword
gitlab.api.params.info.features.variables		keyword
gitlab.api.params.info.features.vault_secrets		keyword
gitlab.api.params.info.name		keyword
gitlab.api.params.info.platform		keyword
gitlab.api.params.info.revision		keyword
gitlab.api.params.info.version		keyword
gitlab.api.params.key		keyword
gitlab.api.params.key_id		keyword
gitlab.api.params.last_update		keyword
gitlab.api.params.name		keyword
gitlab.api.params.private_token		keyword
gitlab.api.params.secret_token		keyword
gitlab.api.params.system_id		keyword
gitlab.api.params.token		keyword
gitlab.api.params.value		keyword
gitlab.api.path		keyword
gitlab.api.path_traversal_check_duration_s		double
gitlab.api.pid		keyword
gitlab.api.queue_duration		float
gitlab.api.queue_duration_s		float
gitlab.api.redis_allowed_cross_slot_calls		long
gitlab.api.redis_cache_calls		long
gitlab.api.redis_cache_duration_s		double
gitlab.api.redis_cache_read_bytes		long
gitlab.api.redis_cache_write_bytes		long
gitlab.api.redis_calls		long
gitlab.api.redis_db_load_balancing_calls		long
gitlab.api.redis_db_load_balancing_duration_s		float
gitlab.api.redis_db_load_balancing_write_bytes		long
gitlab.api.redis_duration_s		float
gitlab.api.redis_feature_flag_calls		long
gitlab.api.redis_feature_flag_duration_s		float
gitlab.api.redis_feature_flag_read_bytes		long
gitlab.api.redis_feature_flag_write_bytes		long
gitlab.api.redis_queues_calls		long
gitlab.api.redis_queues_duration_s		double
gitlab.api.redis_queues_metadata_calls		long
gitlab.api.redis_queues_metadata_duration_s		double
gitlab.api.redis_queues_metadata_read_bytes		long
gitlab.api.redis_queues_metadata_write_bytes		long
gitlab.api.redis_queues_read_bytes		long
gitlab.api.redis_queues_write_bytes		long
gitlab.api.redis_rate_limiting_calls		long
gitlab.api.redis_rate_limiting_duration_s		double
gitlab.api.redis_rate_limiting_read_bytes		long
gitlab.api.redis_rate_limiting_write_bytes		long
gitlab.api.redis_read_bytes		long
gitlab.api.redis_repository_cache_allowed_cross_slot_calls		long
gitlab.api.redis_repository_cache_calls		long
gitlab.api.redis_repository_cache_duration_s		double
gitlab.api.redis_repository_cache_read_bytes		long
gitlab.api.redis_repository_cache_write_bytes		long
gitlab.api.redis_sessions_allowed_cross_slot_calls		long
gitlab.api.redis_sessions_calls		long
gitlab.api.redis_sessions_duration_s		float
gitlab.api.redis_sessions_read_bytes		long
gitlab.api.redis_sessions_write_bytes		long
gitlab.api.redis_shared_state_calls		long
gitlab.api.redis_shared_state_duration_s		double
gitlab.api.redis_shared_state_read_bytes		long
gitlab.api.redis_shared_state_write_bytes		long
gitlab.api.redis_write_bytes		long
gitlab.api.request_urgency		keyword
gitlab.api.route		keyword
gitlab.api.target_duration_s		float
gitlab.api.time		keyword
gitlab.api.token_id		long
gitlab.api.token_type		keyword
gitlab.api.view		double
gitlab.api.view_duration_s		float
gitlab.api.worker_id		keyword
host.containerized	If the host is a container.	boolean
host.os.build	OS build information.	keyword
host.os.codename	OS codename, if any.	keyword
input.type	Type of Filebeat input.	keyword
log.file.device_id	ID of the device containing the filesystem where the file resides.	keyword
log.file.fingerprint	The sha256 fingerprint identity of the file when fingerprinting is enabled.	keyword
log.file.inode	Inode number of the log file.	keyword
log.flags	Flags for the log file.	keyword
log.offset	Offset of the entry in the log file.	long

		{
    "@timestamp": "2024-04-29T17:06:12.231Z",
    "agent": {
        "ephemeral_id": "f0e9557d-9155-4d37-87b7-76055ffa39bc",
        "id": "f9f8a814-dfcd-43c7-a86e-af6adaf2287e",
        "name": "elastic-agent-20638",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "gitlab.api",
        "namespace": "40136",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "f9f8a814-dfcd-43c7-a86e-af6adaf2287e",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "api"
        ],
        "dataset": "gitlab.api",
        "duration": 19690,
        "ingested": "2026-03-30T12:12:59Z",
        "kind": "event",
        "original": "{\"time\":\"2024-04-29T17:06:12.231Z\",\"severity\":\"INFO\",\"duration_s\":0.01969,\"db_duration_s\":0.0,\"view_duration_s\":0.01969,\"status\":200,\"method\":\"GET\",\"path\":\"/api/v4/geo/proxy\",\"params\":[],\"host\":\"localhost\",\"remote_ip\":\"127.0.0.1\",\"ua\":\"Go-http-client/1.1\",\"route\":\"/api/:version/geo/proxy\",\"db_count\":0,\"db_write_count\":0,\"db_cached_count\":0,\"db_txn_count\":0,\"db_replica_txn_count\":0,\"db_primary_txn_count\":0,\"db_main_txn_count\":0,\"db_ci_txn_count\":0,\"db_main_replica_txn_count\":0,\"db_ci_replica_txn_count\":0,\"db_replica_count\":0,\"db_primary_count\":0,\"db_main_count\":0,\"db_ci_count\":0,\"db_main_replica_count\":0,\"db_ci_replica_count\":0,\"db_replica_cached_count\":0,\"db_primary_cached_count\":0,\"db_main_cached_count\":0,\"db_ci_cached_count\":0,\"db_main_replica_cached_count\":0,\"db_ci_replica_cached_count\":0,\"db_replica_wal_count\":0,\"db_primary_wal_count\":0,\"db_main_wal_count\":0,\"db_ci_wal_count\":0,\"db_main_replica_wal_count\":0,\"db_ci_replica_wal_count\":0,\"db_replica_wal_cached_count\":0,\"db_primary_wal_cached_count\":0,\"db_main_wal_cached_count\":0,\"db_ci_wal_cached_count\":0,\"db_main_replica_wal_cached_count\":0,\"db_ci_replica_wal_cached_count\":0,\"db_replica_txn_duration_s\":0.0,\"db_primary_txn_duration_s\":0.0,\"db_main_txn_duration_s\":0.0,\"db_ci_txn_duration_s\":0.0,\"db_main_replica_txn_duration_s\":0.0,\"db_ci_replica_txn_duration_s\":0.0,\"db_replica_duration_s\":0.0,\"db_primary_duration_s\":0.0,\"db_main_duration_s\":0.0,\"db_ci_duration_s\":0.0,\"db_main_replica_duration_s\":0.0,\"db_ci_replica_duration_s\":0.0,\"cpu_s\":0.063617,\"mem_objects\":13367,\"mem_bytes\":1633512,\"mem_mallocs\":7711,\"mem_total_bytes\":2168192,\"pid\":1067,\"worker_id\":\"puma_4\",\"rate_limiting_gates\":[],\"correlation_id\":\"7ff5f562-f16f-4a93-b2ac-f771c81b0495\",\"meta.caller_id\":\"GET /api/:version/geo/proxy\",\"meta.remote_ip\":\"127.0.0.1\",\"meta.feature_category\":\"geo_replication\",\"meta.client_id\":\"ip/127.0.0.1\",\"request_urgency\":\"low\",\"target_duration_s\":5}",
        "provider": "GET /api/:version/geo/proxy",
        "type": [
            "info"
        ]
    },
    "gitlab": {
        "api": {
            "correlation_id": "7ff5f562-f16f-4a93-b2ac-f771c81b0495",
            "cpu_s": 0.063617,
            "db_cached_count": 0,
            "db_ci_cached_count": 0,
            "db_ci_count": 0,
            "db_ci_duration_s": 0,
            "db_ci_replica_cached_count": 0,
            "db_ci_replica_count": 0,
            "db_ci_replica_duration_s": 0,
            "db_ci_replica_txn_count": 0,
            "db_ci_replica_txn_duration_s": 0,
            "db_ci_replica_wal_cached_count": 0,
            "db_ci_replica_wal_count": 0,
            "db_ci_txn_count": 0,
            "db_ci_txn_duration_s": 0,
            "db_ci_wal_cached_count": 0,
            "db_ci_wal_count": 0,
            "db_count": 0,
            "db_duration_s": 0,
            "db_main_cached_count": 0,
            "db_main_count": 0,
            "db_main_duration_s": 0,
            "db_main_replica_cached_count": 0,
            "db_main_replica_count": 0,
            "db_main_replica_duration_s": 0,
            "db_main_replica_txn_count": 0,
            "db_main_replica_txn_duration_s": 0,
            "db_main_replica_wal_cached_count": 0,
            "db_main_replica_wal_count": 0,
            "db_main_txn_count": 0,
            "db_main_txn_duration_s": 0,
            "db_main_wal_cached_count": 0,
            "db_main_wal_count": 0,
            "db_primary_cached_count": 0,
            "db_primary_count": 0,
            "db_primary_duration_s": 0,
            "db_primary_txn_count": 0,
            "db_primary_txn_duration_s": 0,
            "db_primary_wal_cached_count": 0,
            "db_primary_wal_count": 0,
            "db_replica_cached_count": 0,
            "db_replica_count": 0,
            "db_replica_duration_s": 0,
            "db_replica_txn_count": 0,
            "db_replica_txn_duration_s": 0,
            "db_replica_wal_cached_count": 0,
            "db_replica_wal_count": 0,
            "db_txn_count": 0,
            "db_write_count": 0,
            "duration_s": 0.01969,
            "mem_bytes": 1633512,
            "mem_mallocs": 7711,
            "mem_objects": 13367,
            "mem_total_bytes": 2168192,
            "meta": {
                "client_id": "ip/127.0.0.1",
                "feature_category": "geo_replication",
                "remote_ip": "127.0.0.1"
            },
            "request_urgency": "low",
            "route": "/api/:version/geo/proxy",
            "target_duration_s": 5,
            "time": "2024-04-29T17:06:12.231Z",
            "view_duration_s": 0.01969,
            "worker_id": "puma_4"
        }
    },
    "host": {
        "architecture": "x86_64",
        "containerized": false,
        "hostname": "elastic-agent-20638",
        "id": "8259e024976a406e8a54cdbffeb84fec",
        "ip": [
            "192.168.241.2",
            "192.168.240.7"
        ],
        "mac": [
            "2A-FE-08-2F-FD-10",
            "56-3D-E0-9C-4A-D5"
        ],
        "name": "localhost",
        "os": {
            "codename": "focal",
            "family": "debian",
            "kernel": "5.15.0-173-generic",
            "name": "Ubuntu",
            "platform": "ubuntu",
            "type": "linux",
            "version": "20.04.6 LTS (Focal Fossa)"
        }
    },
    "http": {
        "request": {
            "method": "GET"
        },
        "response": {
            "status_code": 200
        }
    },
    "input": {
        "type": "filestream"
    },
    "log": {
        "file": {
            "device_id": "64768",
            "inode": "547212",
            "path": "/tmp/service_logs/test-gitlab-api.log"
        },
        "level": "INFO",
        "offset": 0
    },
    "process": {
        "pid": 1067
    },
    "related": {
        "hosts": [
            "localhost"
        ],
        "ip": [
            "127.0.0.1"
        ]
    },
    "source": {
        "ip": [
            "127.0.0.1"
        ]
    },
    "tags": [
        "preserve_original_event",
        "gitlab-api"
    ],
    "url": {
        "domain": "localhost",
        "path": "/api/v4/geo/proxy"
    },
    "user_agent": {
        "original": "Go-http-client/1.1"
    }
}
		
	

application

Collect logs for events happening in GitLab like user creation or project deletion. Check out the GitLab Application log docs for more information.

Field	Description	Type
@timestamp	Event timestamp.	date
cloud.account.id	The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.	keyword
cloud.availability_zone	Availability zone in which this host is running.	keyword
cloud.image.id	Image ID for the cloud instance.	keyword
cloud.instance.id	Instance ID of the host machine.	keyword
cloud.instance.name	Instance name of the host machine.	keyword
cloud.machine.type	Machine type of the host machine.	keyword
cloud.project.id	Name of the project in Google Cloud.	keyword
cloud.provider	Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.	keyword
cloud.region	Region in which this host is running.	keyword
container.id	Unique container id.	keyword
container.image.name	Name of the image the container was built on.	keyword
container.labels	Image labels.	object
container.name	Container name.	keyword
data_stream.dataset	Data stream dataset name.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset	constant_keyword
event.module	Event module	constant_keyword
gitlab.application.attributes		keyword
gitlab.application.caller		keyword
gitlab.application.class		keyword
gitlab.application.class_name		keyword
gitlab.application.connection_name		keyword
gitlab.application.correlation_id		keyword
gitlab.application.current_iteration		long
gitlab.application.duration_s		double
gitlab.application.event		keyword
gitlab.application.from_state		keyword
gitlab.application.lease_key		keyword
gitlab.application.lease_timeout		long
gitlab.application.lock_timeout_in_ms		long
gitlab.application.login_method		keyword
gitlab.application.mail_subject		keyword
gitlab.application.memwd_cur_strikes		long
gitlab.application.memwd_handler_class		keyword