Struct QueryAuditRecord 

pub struct QueryAuditRecord {

    pub query_id: String,
    pub client_ip: String,
    pub client: String,
    pub agent: String,
    pub entrypoint: String,
    pub session: Option<String>,
    pub notebook: Option<String>,
    pub cell: Option<String>,
    pub user: String,
    pub email: String,
    pub name: Option<String>,
    pub service_account: bool,
    pub service_account_name: Option<String>,
    pub sql: String,
    pub range_begin: Option<String>,
    pub range_end: Option<String>,
    pub limit: Option<u64>,
    pub context_init_ms: f64,
    pub planning_ms: f64,
    pub execution_ms: f64,
    pub setup_ms: f64,
    pub total_ms: f64,
    pub status: &'static str,
    pub error: Option<String>,
    pub error_class: Option<&'static str>,
    pub output_rows: Option<u64>,
    pub bytes_scanned: u64,
    pub peak_memory_bytes: u64,
    pub spilled_bytes: u64,
    pub spill_count: u64,
    pub sql_hash: String,
}

One structured record per FlightSQL query, emitted as a JSON log line under the flightsql_query_audit target when the query completes, fails, or is abandoned mid-drain (client disconnect/cancel).

Fields

query_id: String

Minted as the first statement of execute_query, before any fallible step – always present, so a failure’s server-log line (which also carries it) and this record can be correlated by grepping the id.

client_ip: String

The rightmost X-Forwarded-For entry (the address the trusted proxy in front of this service observed), falling back to X-Real-IP and then the gRPC peer address for a direct connection – see http_utils::get_client_ip. Unlike client/agent/entrypoint below, this comes from the network / trusted-proxy layer rather than from client-controlled attribution headers, so it’s grouped with query_id rather than with the self-reported fields – but that guarantee holds only for requests that actually traversed the trusted proxy; for a direct connection with no proxy in front, both X-Forwarded-For and X-Real-IP are just as caller-chosen as the self-reported fields.

client: String

agent: String

entrypoint: String

session: Option<String>

notebook: Option<String>

Originating notebook name, if the query was issued from a notebook cell.

cell: Option<String>

Originating cell name within the notebook, if the query was issued from a notebook cell.

user: String

email: String

name: Option<String>

service_account: bool

service_account_name: Option<String>

sql: String

range_begin: Option<String>

range_end: Option<String>

limit: Option<u64>

context_init_ms: f64

planning_ms: f64

execution_ms: f64

setup_ms: f64

total_ms: f64

status: &'static str

error: Option<String>

error_class: Option<&'static str>

“user” | “resource” | “internal” | “denied”, derived from the gRPC status code (see flight_sql_service_impl::error_class) – “denied” is stamped directly by the query-deny-list check rather than derived from a DataFusionError. Omitted when status == "ok", matching the error field’s own “on error” convention.

output_rows: Option<u64>

bytes_scanned: u64

peak_memory_bytes: u64

spilled_bytes: u64

spill_count: u64

sql_hash: String

Normalized SQL fingerprint – the first 16 hex chars of the SHA-256 of the literal-stripped, whitespace-collapsed token stream. Computed once per query and emitted on every terminal path regardless of whether the deny list is in active use, since it’s what an operator pastes into deny_queries after finding an offender in the audit log. Appended last so existing JSON consumers are unaffected.

Trait Implementations

impl Serialize for QueryAuditRecord

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.