Importing Auth0 logs using a Custom Webhook

Note

This document refers to the legacy alerting system. See Monitors and Alerts for the updated version.

Use Webhooks to deliver Auth0 log events to Observe and monitor for alerts. When Auth0 creates a log entry for Observe, it sends a copy to the URL using an HTTP POST request. You must create an API to provide a single /api/logs route that accepts POST requests. When a log event occurs in Auth0, Auth0 sends it to Observe.

Note

You can only subscribe one payload URL per Webhook configuration, but you can use the same URL for multiple streams. Autho0 delivers the payload in JSON lines format. Keep that in mind while consuming the logs in your Webhook configuration.

Prerequisites Create a data stream and ingest token to use for this configuration.

To create the webhook, use the following steps:

  1. Log into Auth0.

  2. Choose Monitoring>Logs, and then Create Log Stream.

  3. Choose HTTP target, and then Custom Webhook.

  4. Create a name for the Webhook such as Observe Webhook.

  5. Choose Create.

  6. Enter https://{OBSERVE_CUSTOMER}.collect.observeinc.com/v1/http/auth0 as the Payload URL.

  7. For the Authorization token, enter Bearer {CustomerId} {IngestToken}.

  8. Choose Application/json as the Content Type.

  9. For the Content Filter Category, select All.

  10. Choose Save.

When Auth0 generates log events, you should see them in your Observe data stream.

To view the types of log events generated by Auth0, see Log Event Filters in the Auth0 documentation.