Event Schemas

Event records may vary by enabled modules and version, but should preserve enough context for troubleshooting and SIEM correlation.

Common fields

Field	Meaning
timestamp	Event time.
request_id	Request correlation ID.
component	core, managerd, webgui, or portal.
client_ip	Resolved client IP.
remote_ip	Direct peer IP.
host	Request host.
path	Request path.
method	HTTP method.
module	Module that made or logged the decision.
action	ALLOW, BLOCK, LOG, CHECK, or rate-limit result.
rule_id	Matching rule identifier.
reason	Human-readable reason.
status	Response status.
backend	Selected backend or pool.

Example

{
  "timestamp": "2026-01-01T00:00:00Z",
  "component": "core",
  "request_id": "abc123",
  "client_ip": "203.0.113.10",
  "host": "www.example.com",
  "path": "/login",
  "module": "waf",
  "action": "BLOCK",
  "rule_id": "waf_sqli_union_select",
  "reason": "SQL injection pattern",
  "status": 403
}