Skip to main content

Export Torq Activity and Audit Logs to Amazon S3 Automatically

Set up automatic audit and activity log exports to Amazon S3, ensuring availability for external tools.

Overview

Torq can export audit and activity logs directly to Amazon S3 without requiring workflow logic. Configure export parameters through Log Export settings, including log type, destination, S3 bucket, and optional JSON query filtering. Once configured, the exporter runs automatically in the background.

Key capabilities

Log export is designed for high-volume, low-maintenance log delivery.

  • Automatic deduplication: Detects and filters duplicate events to maintain data integrity in the destination system.

  • JSON query filtering: Filters log entries using JQ expressions to export only events that match specific criteria.

  • High throughput: Supports up to 200,000 events per minute.

To enable audit and activity log export to Amazon S3 for your workspace, contact Torq support.

Prerequisites

Egress IPs

Allow the following IP addresses for outbound log traffic::

  • US Region: 34.45.162.152, 35.224.195.100, 34.30.220.27, 34.55.144.128, 34.31.70.174

  • EU Region: 35.198.189.29, 34.159.57.189, 34.89.150.29, 34.159.167.193, 34.141.112.159

AWS integration

An AWS integration must be configured with the s3:PutObject permission to allow uploading objects to the target S3 bucket. For details, see AWS S3 PutObject documentation.

How to use

Export logs to Amazon S3

  1. Open Log Export: Go to Settings > Log Export and click Add.

  2. Configure the export: In the Export Log dialog, enter the following:

    • Name: A name for the log export configuration.

    • Log type: The type of log to export.

      • Audit: Records user actions within Torq, such as logins and permission changes. Use for security, compliance, and traceability.

      • Activity: Captures system-level events from workflow executions, such as trigger runs and connector steps. Use for monitoring and debugging.

    • Destination: Select AWS S3.

    • Integration instance: Select the AWS integration instance. The integration must include the s3:PutObject permission.

    • Region: Select the AWS S3 region.

    • Bucket: Enter the S3 bucket name.

    • (Optional) Path within bucket: Enter a path within the bucket.

    • (Optional) JSON query: Expand Advanced options and enter a JQ expression to filter log entries. For example, .execution.status == "queued" exports only activity log entries for queued workflows.

  3. Save: Click Add. Torq validates the configuration by uploading a test file named verify-<uuid>. If validation fails, an error appears in the dialog.

Once saved, the log export appears in the list. From there, edit, delete, or pause the configuration as needed.

Export frequency

Exports are triggered automatically when either condition is met first:

  • 50 log entries accumulate, or

  • 60 minutes have elapsed since the last export.

To adjust the export frequency, contact Torq support.

Use workflows for log export

The following steps are available for managing log export configurations from within a workflow:

  • Create Log Export Configuration: Create a new log export by specifying the log type, destination, and AWS integration. Optionally include a JSON query to filter entries. To retrieve the AWS integration ID, use the Get Integration by Name or List Integrations steps.

  • List Log Export Configurations: Retrieve all log export configurations in the workspace.

  • Get Log Export Configuration: Retrieve details for a specific log export by its ID.

Set up log export for a different workspace

A log export can be configured for another workspace using an AWS integration from the current one, as long as an access token for the destination workspace is available.

  1. Share the AWS integration: Use the Create Share Request step to make the AWS integration available in the destination workspace.

  2. Get the AWS integration ID: Run the Get Integration by Name step using the access token from the destination workspace to retrieve the integration ID. To use an access token instead of selecting a Torq integration, click the three-dot menu next to the Integration field and select Set values separately.

  3. Create the log export configuration: Use the Create Log Export Configuration step and specify:

    • Log type (audit or activity)

    • AWS integration ID from the destination workspace

    • Amazon S3 destination

    • Access token for the destination workspace

Related Articles
Did this answer your question?