Definition of a eventname in Cloudtrail logs

Question & Answer
, , ,
1

Hi,

We have cloudtrail logs concerning quicksight stored in table on our redshift cluster.
I am concerned with actions that can be interpreted as user opening and viewing dashboard or analysis.

There are 2 columns I use:

event_name readonly
GetAnalysis, true
GetDashboard, true
QueryDatabase, true

These 3 entries are only ones that are readonly = ‘true’
I noticed I get lot of QueryDatabase events where I would expect GetDashboard.

I looked it up here Tracking non-API events by using CloudTrail logs - Amazon QuickSight, but there is no description as to what each name means.

So how to most accurately track usage of our dashboards?

Thanks,

Daniel

2

Hi Daniel,

Can look for “event source” as “quicksight.amazonaws.com” in cloudtrail event history. You will see getDashboard events as shown in below screenshot. Also, This blog article explain how you can leverage QuickSight cloutrail events and Build an administrative console in Amazon QuickSight to analyze usage metrics
Building an administrative console in Amazon QuickSight to analyze usage metrics | AWS Big Data Blog

image
image2592×760 105 KB

1 Like
3

Hi Ali,

Thanks for reply. More specifically, I am looking for differentiation between GetDashboard and QueryDatabase event names. So my assumption is that when user opens dashboard, there is corresponding entry with ‘GetDashboard’ eventname. Is that correct? And correspondingly, what triggers ‘QueryDatabase’?

Thanks,

Daniel

4

Hello @dubravec, this will depend on how you are utilizing datasets in your dashboards. If you are using direct query, every time a user opens a dashboard, it is going to query the most recent data from your datasource. In that case, any time GetDashboard would run so would QueryDatabase. However, if you ingest your datasets into SPICE in QuickSight, QueryDatabase would only run when you refresh the dataset manually, or on an incremental refresh schedule.

I will mark this as a solution, but if you have any further questions, please let me know!

5

If I’m not wrong, also the application of any filters in the dashboard or the reset of the whole filters trigger the event “QueryDatabase”.
The big limitation is that the logs do not show the ID/name of the filter applied nor the values taken by it.