# audit log contents

Data in your audit logs is stored in the JSON format.

Your JSON logs contain the following fields:

| Fields | Description | Type |
| --- | --- | --- |
| email | The registered email of the user who triggered the<br>logged event. | String |
| logId | The id of the log created for each given<br>event. | String |
| userId | The technical ID of the user account on which the<br>logged event occurred. | String |
| request | The body of the request and the used<br>parameters. | Object |
| clientIp | The IP address of the client sending requests.<br><br>In case you use [AWS PrivateLink](https://help.qlik.com/talend/r/en-US/Cloud/aws-private-link/architecture-of-support-for-privatelink-with-talend), the displayed clientIP is actually a local one<br>that belongs to the Talend Cloud cluster on AWS. | String |
| response | The body of the response and its status.<br><br>The code 200 means that an event was successful and 400 means wrong<br>parameter format was used in your request.<br><br>For information about all the event status code numbers, see<br>above-mentioned API documentation of the Audit logging service. | Object |
| username | The registered name of the user who triggered the<br>logged event. | String |
| accountId | The business ID of the user account with which the logged event is<br>triggered. | String |
| eventType | It records the type of a given event. | String |
| requestId | The id of a given request or transaction. | String |
| timestamp | The time when an event occurs. Its format is<br>yyyy-mm-ddThh:mm:ss.ffff. | String |
| applicationId | The id of the application in which the event occurs. | String |
| eventCategory | The category the recorded event is about, such as the access tokens,<br>the user accounts or the security policies. | String |
| eventOperation | This operation could be Create, Read, Update, Delete, Reset, or<br>Activate and so on. | String |

The following sections provides more details about the events to be logged.