Agentic Data Plane

rpk ai auditlog query

Query audit entries, timeline and facets (set a bounded time window).

This command was introduced in ai version 0.2.94.

Usage

rpk ai auditlog query [flags]

Flags

Value Type Description

--filter.start-time

string

Start time. (RFC 3339, for example, 2026-01-02T15:04:05Z).

--filter.end-time

string

End time. (RFC 3339, for example, 2026-01-02T15:04:05Z).

--filter.outcomes

strings

Outcomes. (one of: allowed, denied, partial, masked; repeatable; replaces the full list on update).

--filter.correlation-id

string

Correlation id.

--filter.query

string

Query.

--filter.terms

stringArray

Terms. (repeatable; field (bare values comma-split) or protojson object; replaces the full list on update).

--entries.page-size

int32

Page size.

--entries.page-token

string

Page token.

--entries.order-by

string

Order by.

--entries.order-ascending

bool

Order ascending. (true when set; pass --entries.order-ascending=false to disable).

--timeline.interval

string

Interval. (Go duration, for example, "90s", "1h30m").

--facets

stringArray

Facets. (repeatable; field (bare values comma-split) or protojson object; replaces the full list on update).

-f, --filename

string

request as YAML or JSON, or - for stdin; flags override file values.

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.