ClickHouse Cloud Audit Logs

Collect organization activity from ClickHouse Cloud, including service, member, role, API key, and authentication events. RunReveal polls the ClickHouse Cloud API every 60 seconds and backfills up to 30 days.

Setup

Create an API key

1. In ClickHouse Cloud, open your organization settings and create an API key for RunReveal.
2. Grant the key the View organization activities permission (control-plane:organization:view-activities). This is a ClickHouse Cloud API key, not a database credential.
3. Copy the key ID and secret. ClickHouse shows the secret only when the key is created.
4. Copy the organization ID from ClickHouse Cloud.

Connect RunReveal

1. Go to Sources → Add Source and select ClickHouse Cloud Audit Logs.
2. Enter the organization ID, API key ID, and API key secret.
3. Click Verify to test access, then save the source.

RunReveal backfills activities oldest-first in six-hour windows, so the backfill takes some time before current activities appear. ClickHouse Cloud does not publish a retention period for the organization activities API, so the amount available during the initial backfill may vary.

Verify ingestion

SELECT *
FROM clickhouse_cloud_audit_logs
ORDER BY eventTime DESC
LIMIT 10

Polling failures appear under Polling errors.

Schema

The clickhouse_cloud_audit_logs view includes RunReveal's normalized columns and these ClickHouse Cloud activity fields:

Helpful links

• ClickHouse Cloud organization activities API