Merge pull request #89 from jfrog/bugfix/JOBS-2031

fix #Rename token_id to trace_id in access-security-audit log parsing

Author: shraddha5718

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All changes to the log analytics integration will be documented in this file.
 
+## [1.0.15] - April 2026
+
+* Fix incorrect field name in access-security-audit log parsing: renamed `token_id` capture group to `trace_id` to match the actual log format documented at https://docs.jfrog.com/administration/docs/audit-trail-log (JOBS-2031)
+
 ## [1.0.14] - April 2026
 
 * Added RTFS (JFrog Artifactory Federation Service) metrics collection support in Artifactory fluentd config (JOBS-1897)

fluent.conf.rt

@@ -272,7 +272,7 @@
   tag jfrog.rt.access.audit
   <parse>
     @type regexp
-    expression /^(?<log_timestamp>[^ ]*)\|(?<token_id>[^ ]*)\|(?<user_ip>[^ ]*)\|(?<user>[^ ]*)\|(?<logged_principal>[^ ]*)\|(?<entity_name>[^ ]*)\|(?<event_type>[^ ]*)\|(?<event>[^ ]*)\|(?<data_changed>.*)/
+    expression /^(?<log_timestamp>[^ ]*)\|(?<trace_id>[^ ]*)\|(?<user_ip>[^ ]*)\|(?<user>[^ ]*)\|(?<logged_principal>[^ ]*)\|(?<entity_name>[^ ]*)\|(?<event_type>[^ ]*)\|(?<event>[^ ]*)\|(?<data_changed>.*)/
     time_key log_timestamp
     time_format %Y-%m-%dT%H:%M:%S.%LZ
   </parse>