Stream Policy Gateway policy events to Elasticsearch or OpenSearch via the Bulk API.
In the console, add a connector with:
| Field | Value |
|---|
| Type | Elastic |
| URL | https://<cluster>:9200 |
| Auth | API key or basic auth |
| Index | e.g. ai-audit or a data stream |
| CA cert (optional) | For self-signed clusters |
Event shape
Events are sent via _bulk as NDJSON:
{"index":{"_index":"ai-audit"}}
{"@timestamp":"2026-04-20T18:30:00Z","event_id":"3d14a2b8-...","event_type":"enforcement","policy_id":"support-bot","decision":"refuse","effective_decision":"allow","enforced":false,"rollout_mode":"shadow","reason_code":"REFUSE","policy_target":"chat.completions","project_id":"proj_support_bot","model":"abliterated-model","denylist_hits":["competitor-x"]}
Index template
Recommended mapping:
{
"mappings": {
"properties": {
"@timestamp": { "type": "date" },
"event_id": { "type": "keyword" },
"event_type": { "type": "keyword" },
"policy_id": { "type": "keyword" },
"decision": { "type": "keyword" },
"effective_decision": { "type": "keyword" },
"enforced": { "type": "boolean" },
"rollout_mode": { "type": "keyword" },
"reason_code": { "type": "keyword" },
"policy_target": { "type": "keyword" },
"project_id": { "type": "keyword" },
"model": { "type": "keyword" },
"triggered_categories": { "type": "keyword" },
"allowlist_hits": { "type": "keyword" },
"denylist_hits": { "type": "keyword" }
}
}
}
Verify
GET ai-audit/_search
{ "query": { "term": { "decision": "refuse" } } }
Last modified on April 21, 2026
