baron-sso/docker/ory/vector/vector.toml

[sources.oathkeeper_file]
  type = "file"
  include = ["/var/log/oathkeeper/access.log"]
  read_from = "beginning"

[transforms.oathkeeper_parse]
  type = "remap"
  inputs = ["oathkeeper_file"]
  source = '''
    raw = to_string(.message) ?? ""
    parsed = object!(parse_json(raw) ?? {})
    request_method = to_string(get(parsed, ["request", "method"]) ?? "") ?? ""
    if request_method == "" { request_method = to_string(get(parsed, ["http_request", "method"]) ?? "") ?? "" }
    request_path = to_string(get(parsed, ["request", "path"]) ?? "") ?? ""
    if request_path == "" { request_path = to_string(get(parsed, ["http_request", "path"]) ?? "") ?? "" }
    request_url = to_string(get(parsed, ["request", "url"]) ?? "") ?? ""
    if request_url == "" { request_url = to_string(get(parsed, ["http_url"]) ?? "") ?? "" }
    request_host = to_string(get(parsed, ["request", "host"]) ?? "") ?? ""
    if request_host == "" { request_host = to_string(get(parsed, ["http_request", "host"]) ?? "") ?? "" }
    request_scheme = to_string(get(parsed, ["request", "scheme"]) ?? "") ?? ""
    if request_scheme == "" { request_scheme = to_string(get(parsed, ["http_request", "scheme"]) ?? "") ?? "" }
    request_query = to_string(get(parsed, ["request", "query"]) ?? "") ?? ""
    if request_query == "" { request_query = to_string(get(parsed, ["http_request", "query"]) ?? "") ?? "" }
    response_status = to_int(get(parsed, ["response", "status"]) ?? 0) ?? 0
    if response_status == 0 { response_status = to_int(get(parsed, ["http_response", "status"]) ?? 0) ?? 0 }
    response_size = to_int(get(parsed, ["response", "size"]) ?? 0) ?? 0
    if response_size == 0 { response_size = to_int(get(parsed, ["http_response", "size"]) ?? 0) ?? 0 }
    response_took = to_int(get(parsed, ["response", "took"]) ?? 0) ?? 0
    if response_took == 0 { response_took = to_int(get(parsed, ["http_response", "took"]) ?? 0) ?? 0 }
    identity_id = to_string(get(parsed, ["identity", "id"]) ?? "") ?? ""
    if identity_id == "" { identity_id = to_string(get(parsed, ["subject"]) ?? "") ?? "" }
    headers = object(get(parsed, ["headers"]) ?? {}) ?? {}
    if length(headers) == 0 { headers = object(get(parsed, ["http_request", "headers"]) ?? {}) ?? {} }
    user_agent = to_string(get(headers, ["User-Agent"]) ?? "") ?? ""
    if user_agent == "" { user_agent = to_string(get(headers, ["user-agent"]) ?? "") ?? "" }
    referer = to_string(get(headers, ["Referer"]) ?? "") ?? ""
    if referer == "" { referer = to_string(get(headers, ["referer"]) ?? "") ?? "" }
    rule_id = to_string(get(parsed, ["rule", "id"]) ?? "") ?? ""
    if rule_id == "" { rule_id = to_string(get(parsed, ["rule_id"]) ?? "") ?? "" }
    upstream_url = to_string(get(parsed, ["upstream", "url"]) ?? "") ?? ""
    if upstream_url == "" { upstream_url = to_string(get(parsed, ["http_url"]) ?? "") ?? "" }
    client_id = to_string(get(parsed, ["client", "id"]) ?? "") ?? ""
    parent_session_id = to_string(get(parsed, ["extra", "parent_session_id"]) ?? "") ?? ""
    parsed_url = parse_url(request_url) ?? {}
    query_params = get(parsed_url, ["query"]) ?? {}
    url_path = to_string(get(parsed_url, ["path"]) ?? "") ?? ""
    parsed_request_query = parse_url("http://localhost/?" + request_query) ?? {}
    request_query_params = get(parsed_request_query, ["query"]) ?? {}
    event_path = to_string(parsed.path) ?? to_string(parsed.http_path) ?? ""
    if event_path == "" { event_path = request_path }
    if event_path == "" { event_path = url_path }
    if event_path == "" { event_path = request_url }
    event_client_id = to_string(parsed.client_id) ?? ""
    if event_client_id == "" { event_client_id = client_id }
    if event_client_id == "" { event_client_id = to_string(get(query_params, ["client_id"]) ?? "") ?? "" }
    if event_client_id == "" { event_client_id = to_string(get(query_params, ["clientId"]) ?? "") ?? "" }
    if event_client_id == "" { event_client_id = to_string(get(request_query_params, ["client_id"]) ?? "") ?? "" }
    if event_client_id == "" { event_client_id = to_string(get(request_query_params, ["clientId"]) ?? "") ?? "" }
    event_latency_ms = to_int(parsed.latency_ms) ?? to_int(parsed.duration_ms) ?? 0
    if event_latency_ms == 0 && response_took != 0 {
      event_latency_ms = to_int(to_float(response_took) / 1000000.0)
    }
    event_client_ip = to_string(parsed.client_ip) ?? to_string(parsed.remote_ip) ?? to_string(parsed.ip) ?? ""
    if event_client_ip == "" { event_client_ip = to_string(get(headers, ["X-Real-Ip"]) ?? "") ?? "" }
    if event_client_ip == "" { event_client_ip = to_string(get(headers, ["x-real-ip"]) ?? "") ?? "" }
    if event_client_ip == "" { event_client_ip = to_string(get(headers, ["X-Forwarded-For"]) ?? "") ?? "" }
    if event_client_ip == "" { event_client_ip = to_string(get(headers, ["x-forwarded-for"]) ?? "") ?? "" }
    event_decision = to_string(parsed.decision) ?? to_string(parsed.result) ?? ""
    if event_decision == "" && exists(parsed.granted) {
      if parsed.granted == true {
        event_decision = "granted"
      } else {
        event_decision = "denied"
      }
    }
    event_status = to_int(get(parsed, ["status"]) ?? 0) ?? 0
    if event_status == 0 { event_status = to_int(get(parsed, ["status_code"]) ?? 0) ?? 0 }
    if event_status == 0 { event_status = response_status }
    event_bytes_out = to_int(get(parsed, ["bytes_out"]) ?? 0) ?? 0
    if event_bytes_out == 0 { event_bytes_out = to_int(get(parsed, ["response_bytes"]) ?? 0) ?? 0 }
    if event_bytes_out == 0 { event_bytes_out = response_size }
    event_method = to_string(get(parsed, ["method"]) ?? "") ?? ""
    if event_method == "" { event_method = to_string(get(parsed, ["http_method"]) ?? "") ?? "" }
    if event_method == "" { event_method = request_method }
    event_host = to_string(get(parsed, ["host"]) ?? "") ?? ""
    if event_host == "" { event_host = to_string(get(parsed, ["http_host"]) ?? "") ?? "" }
    if event_host == "" { event_host = request_host }
    event_scheme = to_string(get(parsed, ["scheme"]) ?? "") ?? ""
    if event_scheme == "" { event_scheme = request_scheme }
    event_query = to_string(get(parsed, ["query"]) ?? "") ?? ""
    if event_query == "" { event_query = request_query }
    event_user_agent = to_string(get(parsed, ["user_agent"]) ?? "") ?? ""
    if event_user_agent == "" { event_user_agent = to_string(get(parsed, ["http_user_agent"]) ?? "") ?? "" }
    if event_user_agent == "" { event_user_agent = user_agent }

    . = {
      "request_id": to_string(parsed.request_id) ?? to_string(parsed.req_id) ?? "",
      "method": event_method,
      "path": event_path,
      "status": event_status,
      "latency_ms": event_latency_ms,
      "client_id": event_client_id,
      "rp": to_string(parsed.rp) ?? "",
      "action": to_string(parsed.action) ?? "",
      "target": to_string(parsed.target) ?? "",
      "rule_id": to_string(parsed.rule_id) ?? rule_id,
      "host": event_host,
      "scheme": event_scheme,
      "query": event_query,
      "upstream_url": to_string(parsed.upstream_url) ?? upstream_url,
      "subject": to_string(parsed.subject) ?? identity_id,
      "parent_session_id": to_string(parsed.parent_session_id) ?? parent_session_id,
      "client_ip": event_client_ip,
      "user_agent": event_user_agent,
      "referer": referer,
      "decision": event_decision,
      "bytes_in": to_int(parsed.bytes_in) ?? to_int(parsed.request_bytes) ?? 0,
      "bytes_out": event_bytes_out,
      "trace_id": to_string(parsed.trace_id) ?? "",
      "span_id": to_string(parsed.span_id) ?? "",
      "raw": raw
    }
  '''

[sinks.clickhouse]
  type = "clickhouse"
  inputs = ["oathkeeper_parse"]
  endpoint = "http://ory_clickhouse:8123"
  database = "ory"
  table = "oathkeeper_access_logs"
  compression = "gzip"
  auth.strategy = "basic"
  auth.user = "${ORY_CLICKHOUSE_USER}"
  auth.password = "${ORY_CLICKHOUSE_PASSWORD}"

[[tests]]
  name = "parses_oathkeeper_v26_completed_request"

  [[tests.inputs]]
    insert_at = "oathkeeper_parse"
    type = "log"

    [tests.inputs.log_fields]
      message = '{"http_request":{"headers":{"user-agent":"Mozilla/5.0","referer":"http://localhost:5173/","x-real-ip":"172.19.0.1"},"host":"localhost","method":"GET","path":"/oauth2/auth","query":"client_id=orgfront&response_type=code","remote":"172.23.0.2:56744","scheme":"http"},"http_response":{"status":302,"size":1339,"took":4854092},"http_url":"http://hydra:4444/oauth2/auth?client_id=orgfront&redirect_uri=http%3A%2F%2Flocalhost%3A5175%2Fauth%2Fcallback","level":"info","msg":"completed handling request","subject":"","time":"2026-05-06T01:40:51.46074548Z"}'

  [[tests.outputs]]
    extract_from = "oathkeeper_parse"

    [[tests.outputs.conditions]]
      type = "vrl"
      source = '''
        assert_eq!(.method, "GET")
        assert_eq!(.path, "/oauth2/auth")
        assert_eq!(.status, 302)
        assert_eq!(.client_id, "orgfront")
        assert_eq!(.host, "localhost")
        assert_eq!(.scheme, "http")
        assert_eq!(.user_agent, "Mozilla/5.0")
        assert_eq!(.referer, "http://localhost:5173/")
      '''

[[tests]]
  name = "parses_oathkeeper_v26_granted_request"

  [[tests.inputs]]
    insert_at = "oathkeeper_parse"
    type = "log"

    [tests.inputs.log_fields]
      message = '{"audience":"application","granted":true,"http_host":"hydra:4444","http_method":"GET","http_url":"http://hydra:4444/oauth2/auth?client_id=orgfront&redirect_uri=http%3A%2F%2Flocalhost%3A5175%2Fauth%2Fcallback&response_type=code","http_user_agent":"curl/8.10.1","level":"info","msg":"Access request granted","service_name":"ORY Oathkeeper","service_version":"v26.2.0","subject":"","time":"2026-05-06T01:52:25.431Z"}'

  [[tests.outputs]]
    extract_from = "oathkeeper_parse"

    [[tests.outputs.conditions]]
      type = "vrl"
      source = '''
        assert_eq!(.method, "GET")
        assert_eq!(.path, "/oauth2/auth")
        assert_eq!(.status, 0)
        assert_eq!(.client_id, "orgfront")
        assert_eq!(.decision, "granted")
      '''