start

{              
  "metadata": {                // Metadata associated with the new export.
    "id": string,              // [identifier]
                               // Identifier for the resource, unique for its resource type.
    "labels": {                // [map]
                               // Labels associated with the resource.
      string: string                  
    },
    "name": string,            // Human readable name for the resource.
    "parent_id": string,       // [required]
                               // Identifier of the parent resource to which the resource belongs.
    "resource_version": int64  // Version of the resource for safe concurrent modifications and consistent reads.
                               // Positive and monotonically increases on each resource spec change (but *not* on each change of the
                               // resource's container(s) or status).
                               // Service allows zero value or current.
  },
  "spec": {                    // Specification for the new export.
    "nebius_object_storage": { // An object storage bucket that will be used as the destination for audit logs.
                               // You must have `storage.upload` permission for successful execution.
      "bucket_by_id": {
        "id": string    // [required]
                        // The id of the bucket in the tenant where the logs will be exported.
      },
      "object_prefix": string  // Prefix for export objects.
                               // Default value is `auditlogs`.
    },
    "params": {                       // [required]
                                      // Filter based on which audit logs must be exported.
      "event_type": enum(         // [required]
                                  // Type of audit event to filter by.
        "EVENT_TYPE_UNSPECIFIED", // Unspecified event type.
        "CONTROL_PLANE",          // Control plane events.
        "DATA_PLANE"              // Data plane events (S3).
      ),
      "filter": string,               // [sensitive]
                                      // Example:
                                      // service.name = 'iam' AND resource.hierarchy.id:'container-e0t' AND regex(resource.metadata.name, '^.*test.*$')
                                      // 
                                      // Supported filters:
                                      // "=" - equals
                                      // "!=" - not equals
                                      // ":" - contains
                                      // regex - regular expression
                                      // 
                                      // Fields that can be used for filtering:
                                      // action
                                      // authentication.static_key_credential.id
                                      // authentication.subject.service_account_id
                                      // authentication.subject.tenant_user_id
                                      // authentication.token_credential.masked_token
                                      // project_region.name
                                      // resource.hierarchy.id
                                      // resource.hierarchy.name
                                      // resource.metadata.id
                                      // resource.metadata.name
                                      // resource.metadata.type
                                      // service.name
                                      // type
                                      // status.
      "from": "1970-01-31T02:30:59Z", // [required] [google.protobuf.Timestamp]
                                      // Returns results with a timestamp greater than or equal to this value.
      "to": "1970-01-31T02:30:59Z"    // [required] [google.protobuf.Timestamp]
                                      // Returns results with a timestamp lower than this value.
    }
  }
}