Copy page

GitHub

Copilot Logs

Retrieves GitHub Copilot activity logs from GitHub Enterprise audit logs. Automatically filters to Copilot-related events (action:copilot.*).

Sync Type: Incremental

Requirements

Before configuring this input, you need to:

1. Create a Personal Access Token (PAT) — GitHub docs.

   • Go to your GitHub settings
   • Navigate to Developer settings > Personal access tokens > Tokens (classic)
   • Click "Generate new token (classic)"
   • Select the read:audit_log scope
   • Copy and securely store the generated token

2. Required Permissions:

   • You must be an enterprise admin to access enterprise audit logs
   • The PAT must have the read:audit_log scope

Configuration

Settings

Setting	Type	Required	Default	Description
enterprise	string	Yes	-	Your GitHub enterprise slug or ID
bot_actions_only	boolean	No	false	When enabled, only returns events initiated by the Copilot bot (actor). When disabled, returns all Copilot-related events including human-initiated ones.
backfill_start_time	string	No	-	Date to start fetching data from (ISO 8601). If not specified, no past records are fetched.

Secrets

Secret	Type	Required	Description
personal_access_token	string	Yes	GitHub Personal Access Token with read scope

Troubleshooting

Common issues and solutions:

1. Rate Limit Errors

• The input automatically handles rate limiting by waiting for the reset period
• You'll see logs indicating the wait time when rate limits are hit

2. Authentication Errors

• Verify your PAT has the read:audit_log scope
• Ensure the PAT hasn't expired
• Confirm you have enterprise admin access

3. No Data

• Check if your enterprise slug/ID is correct
• Verify that Copilot events exist in the time range you're querying
• Ensure you have Copilot enabled in your enterprise

Related Articles

• GitHub Copilot Audit Log Documentation
• GitHub Personal Access Tokens

Sample Record

Code
{
  "@timestamp": 1754956009902,
  "_document_id": "97b9a650-f761-bb7b-7c7d-d268c12e780a",
  "action": "copilot.add_seats",
  "actor": "admin-user",
  "actor_id": 490095,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "US"
  },
  "business": "example-inc",
  "business_id": 96281,
  "created_at": 1754956009902,
  "operation_type": "create",
  "org": "example-org",
  "org_id": 73860966,
  "user": "Alice Miller",
  "user_id": 698322
}

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.