[new integration] Backstage audit logs

packages/backstage/LICENSE.txt

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

packages/backstage/_dev/build/build.yml

@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: "git@v9.4.0"

packages/backstage/_dev/build/docs/README.md

@@ -0,0 +1,106 @@
+# Backstage Integration for Elastic
+
+## Overview
+
+The Backstage integration for Elastic collects audit log events emitted by [Backstage](https://backstage.io)'s built-in `auditor` service, giving you visibility into user actions, plugin activity, and catalog operations across your Backstage instance. Events are parsed and normalized into the Elastic Common Schema (ECS) so you can search, alert on, and visualize user and plugin activity across your developer platform.
+
+### Compatibility
+
+This integration is compatible with Backstage backends built on `@backstage/backend-plugin-api` version `1.2.0` or later, the release that introduced the built-in `auditor` core service (implemented by default via `@backstage/backend-defaults`). No additional Backstage plugin is required — every Backstage backend created with `createBackend()` emits audit events through this service automatically.
+
+### How it works
+
+Backstage's `auditor` service formats each audit event as a single JSON log line (message format `<plugin>.<eventId>`) through the root Winston logger, along with fields such as the acting user, HTTP request details, the originating plugin, event status, and severity level. This integration's filestream input reads those JSON lines from a log file — for example, captured container or pod output, or a file the Backstage backend writes to directly — and the ingest pipeline parses and maps them to ECS.
+
+## What data does this integration collect?
+
+The Backstage integration collects audit log events of the following types, depending on which plugins emit `auditor` events in your Backstage instance:
+* Catalog operations: entity fetch and catalog query events, including the requested fields and applied filters.
+* User and plugin activity: the acting user or service, the plugin and event name, HTTP method and URL, and whether the operation succeeded, failed, or is still in progress.
+* Severity-classified events: each event carries a Backstage-assigned severity level (`low`, `medium`, or `high`), mapped to `event.severity`.
+
+### Supported use cases
+
+Integrating Backstage audit logs with the Elastic Stack lets you:
+* Monitor user activity: track who accessed or modified catalog entities, and from where.
+* Investigate plugin behavior: correlate events by `event.provider` (the Backstage plugin) and `event.code` (the audit event ID) to debug or audit plugin-specific actions.
+* Support compliance and security monitoring: maintain a searchable, ECS-normalized record of administrative and catalog actions performed through Backstage.
+
+## What do I need to use this integration?
+
+To use this integration, you'll need the following vendor prerequisites:
+- A Backstage backend built with `createBackend()` from `@backstage/backend-defaults` (version `1.2.0` or later), so the `auditor` service is available and emitting events automatically.
+- The audit log output written to a location the Elastic Agent can read as a file — for example, captured container/pod logs mounted into the Elastic Agent's filesystem, or a file the Backstage backend logs to directly.
+
+You'll also need the following Elastic prerequisites:
+- Elastic Stack (Elasticsearch and Kibana) version `8.19.0` or later.
+- An active Elastic Agent installed and enrolled in Fleet, with filesystem access to the Backstage audit log file(s).
+
+## How do I deploy this integration?
+
+### Agent-based deployment
+
+Elastic Agent must be installed on a host or container that has access to the Backstage audit log file(s). For more details, check the Elastic Agent [installation instructions](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). You can install only one Elastic Agent per host.
+
+Elastic Agent is required to collect the log file(s) and ship the data to Elastic, where the events are then processed by this integration's ingest pipeline.
+
+### Onboard / configure
+
+1. In Kibana, navigate to **Management → Integrations**.
+2. Search for **Backstage** and select the integration.
+3. Click **Add Backstage**.
+4. Configure **Paths** to point to the location of the Backstage audit log file(s) — for example, a mounted volume or captured container log path. The default is `/var/log/*.log`.
+5. (Optional) Configure **Exclude files** to skip rotated or compressed log files. The default already excludes `.gz` files.
+6. (Optional) Configure **Parsers** if your Backstage audit log lines are pretty-printed across multiple lines rather than one JSON object per line. See the field's description for `ndjson` and `multiline` examples.
+7. Assign the integration to an Elastic Agent policy and click **Save and continue**.
+
+### Validation
+
+After the configuration is complete, follow these steps to verify data is flowing correctly from Backstage to the Elastic Stack:
+
+1. Trigger an audit event in Backstage — for example, browse the Software Catalog to trigger a `catalog.entity-fetch` event.
+2. In Kibana, navigate to **Analytics → Discover**.
+3. Select the `logs-*` data view.
+4. In the search bar, enter the filter: `data_stream.dataset: "backstage.audit_logs"`.
+5. Verify that events appear with a non-null `event.action` field, and that `event.provider` reflects the Backstage plugin that generated the event (for example, `catalog`).
+
+## Troubleshooting
+
+For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems).
+
+### Common configuration issues
+
+- **No events collected**: Confirm the Backstage backend is emitting audit events (not every plugin calls the `auditor` service for every operation) and that the configured **Paths** match the actual log file location.
+- **Multi-line JSON not parsed**: If your Backstage deployment pretty-prints JSON log lines across multiple lines, enable the `multiline` parser under **Parsers**. Otherwise, partial lines are dropped by the pipeline's `isAuditEvent` check.
+- **Events silently dropped**: The ingest pipeline drops any line that doesn't contain an `isAuditEvent` key, so non-audit application logs mixed into the same file are expected to be filtered out.
+
+## Scaling
+
+For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.
+
+## Reference
+
+### Inputs used
+
+The following inputs are used by this integration:
+
+{{ inputDocs }}
+
+### Data streams
+
+#### audit_logs
+
+The `audit_logs` data stream provides audit events from Backstage's `auditor` service, including catalog operations, user activity, and other plugin-specific audit events.
+
+##### audit_logs fields
+
+{{ fields "audit_logs" }}
+
+##### audit_logs sample event
+
+{{ event "audit_logs" }}
+
+### Vendor documentation links
+
+For more information about Backstage's auditor service, refer to:
+* [Backstage Auditor Service documentation](https://backstage.io/docs/backend-system/core-services/auditor)

packages/backstage/_dev/deploy/docker/docker-compose.yml

@@ -0,0 +1,11 @@
+version: "2.3"
+services:
+  backstage-audit:
+    image: alpine
+    hostname: backstage-audit
+    # environment:
+    #   SERVICE_LOGS_DIR: "./test_service_logs"
+    volumes:
+      - ./sample_logs:/sample_logs:ro
+      - ${SERVICE_LOGS_DIR}:/var/log/
+    command: /bin/sh -c "cp /sample_logs/* /var/log/"

packages/backstage/_dev/deploy/docker/sample_logs/test-audit-events.log

@@ -0,0 +1 @@
+{"actor":{"hostname":"localhost","ip":"127.0.0.1","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"},"eventId":"entity-fetch","isAuditEvent":true,"level":"info","message":"catalog.entity-fetch","meta":{"query":{"fields":["metadata","kind","spec.profile"],"filter":["kind=group,relations.hasMember=user:default/guest"]},"queryType":"all"},"plugin":"catalog","request":{"method":"GET","url":"/api/catalog/entities?fields=metadata,kind,spec.profile&filter=kind%3Dgroup%2Crelations.hasMember%3Duser%3Adefault%2Fguest"},"service":"backstage","severityLevel":"low","status":"initiated","timestamp":"2026-05-22T20:30:05.131Z"}

packages/backstage/changelog.yml

@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.0.1"
+  changes:
+    - description: Initial draft of the package
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/19408

packages/backstage/data_stream/audit_logs/_dev/test/pipeline/test-audit.log

@@ -0,0 +1,11 @@
+{"actor":{"hostname":"localhost","ip":"127.0.0.1","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"},"eventId":"entity-fetch","isAuditEvent":true,"level":"info","message":"catalog.entity-fetch","meta":{"query":{"fields":["metadata","kind","spec.profile"],"filter":["kind=group,relations.hasMember=user:default/guest"]},"queryType":"all"},"plugin":"catalog","request":{"method":"GET","url":"/api/catalog/entities?fields=metadata,kind,spec.profile&filter=kind%3Dgroup%2Crelations.hasMember%3Duser%3Adefault%2Fguest"},"service":"backstage","severityLevel":"low","status":"initiated","timestamp":"2026-05-22T20:30:05.131Z"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"user:default/alice.johnson","ip":"::ffff:198.51.100.10","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0"},"eventId":"entity-facets","isAuditEvent":true,"level":"info","message":"catalog.entity-facets","plugin":"catalog","request":{"method":"GET","url":"/api/catalog/entity-facets?facet=metadata.namespace&filter=kind%3Dcomponent"},"service":"backstage","severityLevel":"low","status":"initiated"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"user:default/alice.johnson","ip":"::ffff:198.51.100.11","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0"},"eventId":"entity-facets","isAuditEvent":true,"level":"info","message":"catalog.entity-facets","plugin":"catalog","request":{"method":"GET","url":"/api/catalog/entity-facets?facet=metadata.tags&filter=kind%3Dcomponent"},"service":"backstage","severityLevel":"low","status":"succeeded"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"backstage-proxy","ip":"::ffff:198.51.100.20","userAgent":"api-service"},"eventId":"entity-fetch","isAuditEvent":true,"level":"info","message":"catalog.entity-fetch","meta":{"query":{"filter":["kind=Resource,spec.type=github-repository,spec.implementation.apiVersion=github.example.com/v1"]},"queryType":"all"},"plugin":"catalog","request":{"method":"GET","url":"/api/catalog/entities/?filter=kind%3DResource%2Cspec.type%3Dgithub-repository%2Cspec.implementation.apiVersion%3Dgithub.example.com%2Fv1"},"service":"backstage","severityLevel":"low","status":"initiated"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"backstage-proxy","ip":"::ffff:198.51.100.21","userAgent":"api-service"},"eventId":"entity-fetch","isAuditEvent":true,"level":"info","message":"catalog.entity-fetch","meta":{"query":{"filter":["kind=NothingOfThisKind"]},"queryType":"all"},"plugin":"catalog","request":{"method":"GET","url":"/api/catalog/entities?filter=kind%3DNothingOfThisKind"},"service":"backstage","severityLevel":"low","status":"succeeded"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"backstage-proxy","ip":"::ffff:198.51.100.22","userAgent":"api-service"},"eventId":"entity-fetch","isAuditEvent":true,"level":"info","message":"catalog.entity-fetch No entity named 'alice.johnson' found, with kind 'user' in namespace 'default'","meta":{"entityRef":"user:default/alice.johnson","queryType":"by-name"},"plugin":"catalog","request":{"method":"GET","url":"/api/catalog/entities/by-name/user/default/alice.johnson?"},"service":"backstage","severityLevel":"low","status":"failed"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"user:default/alice.johnson","ip":"::ffff:198.51.100.10","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"},"eventId":"task","isAuditEvent":true,"level":"info","message":"scaffolder.task","meta":{"actionType":"stream","taskId":"b1d1549e-4a46-4159-a1af-293cc89eecae"},"plugin":"scaffolder","request":{"method":"GET","url":"/api/scaffolder/v2/tasks/b1d1549e-4a46-4159-a1af-293cc89eecae/eventstream"},"service":"backstage","severityLevel":"low","status":"initiated"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"user:default/alice.johnson","ip":"::ffff:198.51.100.10","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"},"eventId":"task","isAuditEvent":true,"level":"info","message":"scaffolder.task","meta":{"actionType":"stream","taskId":"b1d1549e-4a46-4159-a1af-293cc89eecae"},"plugin":"scaffolder","request":{"method":"GET","url":"/api/scaffolder/v2/tasks/b1d1549e-4a46-4159-a1af-293cc89eecae/eventstream"},"service":"backstage","severityLevel":"low","status":"succeeded"}
+{"actor":{"actorId":"plugin:scaffolder"},"eventId":"task","isAuditEvent":true,"level":"info","message":"scaffolder.task Could not find main. {data={\"what\":\"main\"}}","meta":{"actionType":"execution","templateRef":"template:default/register-in-catalog","createdBy":"user:default/alice.johnson","taskParameters":{"owner":"group:default/example-platform-engineering","securityLevel":"high","createBoilerplateInGuestRepo":false,"division":"engineering","org":"platform","name":"ansible-example-cloud-enterprise","mainBranch":"main","githubOrg":"example-org"},"taskId":"3a03bcc9-48b3-4ecf-98c4-2a98caf9be85"},"plugin":"scaffolder","service":"backstage","severityLevel":"medium","status":"failed"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"user:default/alice.johnson","ip":"::ffff:198.51.100.12","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"},"eventId":"template-parameter-schema","isAuditEvent":true,"level":"info","message":"scaffolder.template-parameter-schema","meta":{"templateRef":"template:default/starter-kit"},"plugin":"scaffolder","request":{"method":"GET","url":"/api/scaffolder/v2/templates/default/template/starter-kit/parameter-schema"},"service":"backstage","severityLevel":"low","status":"initiated"}
+{"actor":{"hostname":"backstage.example.internal","actorId":"user:default/alice.johnson","ip":"::ffff:198.51.100.12","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"},"eventId":"template-parameter-schema","isAuditEvent":true,"level":"info","message":"scaffolder.template-parameter-schema","meta":{"templateRef":"Template:default/starter-kit"},"plugin":"scaffolder","request":{"method":"GET","url":"/api/scaffolder/v2/templates/default/template/starter-kit/parameter-schema"},"service":"backstage","severityLevel":"low","status":"succeeded"}