ai.raw.openai.admin_logs
This dataset is restricted by default: no one can read its data until access is granted through a target group rule on its access policy. To grant access, see Access control.
Purpose
The ai.raw.openai.admin_logs dataset stores the raw records that the OpenAI API Platform integration pulls from the OpenAI Administration APIs. Alongside the integration's metrics, it gives you the full source records and details that the metrics don't carry: the exact usage row behind a token spike, the cost line item for a project, or the audit event that changed an API key.
ai.raw.openai.admin_logs is a predefined dataset: Coralogix provisions it in the default dataspace, and your OpenAI integration fills it. Its entity type is rawOpenAiAdminLogs.
What one event is
Each event is one record from one Administration API endpoint: one usage row, one cost row, one directory or governance object, or one audit event. The stream field names the endpoint the record came from, and data holds the record as OpenAI returned it, with a few fields added by Coralogix.
| Field | Description |
|---|---|
stream | The source endpoint, for example openai.administration.costs. See Streams. |
data | The OpenAI record. Field names follow the OpenAI Administration API. |
data.organization | The OpenAI organization the record belongs to. Added by Coralogix. |
data.bucket_start | Start of the usage or cost bucket, as a Unix timestamp. Present on usage and cost records. |
data.user_email, data.project_name | Resolved user email and project name on cost records, when OpenAI doesn't return them. |
data.scope, data.project_id | Whether a governance record applies to the organization (org) or a project, and which project. |
resource.attributes | Integration metadata: service.name, cx.application.name, cx.subsystem.name, cx.integration.source.type, cx.integration.source.version, and organization. |
Minute-level completions usage is timestamped at the start of its bucket. Daily usage and cost rows are usually collected after their day ends, so they take the collection time; use data.bucket_start for the bucket. A bucket read while still open is written again when it's re-read, so keep the latest copy per data.bucket_start and grouping fields (project, model, API key, user, line item) when you sum. Directory, governance, role-based access control, and audit events are timestamped when Coralogix collects them. For the time an audit event happened, use data.effective_at.
Streams
Each stream name takes the openai.administration. prefix. The table shows the full name only for the first stream in each row.
| Group | Streams |
|---|---|
| Usage | openai.administration.usage_completions, usage_embeddings, usage_images, usage_audio_speeches, usage_audio_transcriptions, usage_moderations, usage_vector_stores, usage_code_interpreter_sessions, usage_web_search_calls, usage_file_search_calls |
| Cost and spend | openai.administration.costs, spend_limit, spend_alerts |
| Directory | openai.administration.users, projects, project_users, api_keys, service_accounts, invites, admin_keys |
| Governance | openai.administration.data_retention, certificates, project_certificates, certificate_content, rate_limits, model_permissions, hosted_tool_permissions |
| Role-based access control | openai.administration.groups, group_roles, roles, user_roles, project_groups, project.roles, project.user_roles |
| Audit | openai.administration.audit |
Audit events also carry the actor's session details at the top level of data: ip_address, user_agent, ja3, ja4, and the IP location fields country, city, region, region_code, asn, latitude, and longitude.
Query the dataset
source ai.raw.openai.admin_logs
| filter $d.stream == 'openai.administration.audit'
Next steps
- Set up the source: OpenAI API Platform integration.
- Grant read access to more users: Access control.
- See the other datasets Coralogix provisions in Predefined datasets.