# Reporting

## Incident logs integration

The Incident Log integration allows you to send detailed audit logs of various events related to your monitors, heartbeats, and incidents to an external logging service via webhooks. Each event is formatted as a JSON payload, providing comprehensive information about what happened, when, and to which resource.

Each payload includes common fields:

| Field             | Type   | Description                                                                 |
| :---------------- | :----- | :-------------------------------------------------------------------------- |
| `dt`              | String | ISO 8601 formatted timestamp of when the event occurred.                    |
| `event`           | String | The type of event (e.g., `monitor.created`, `incident.started`).            |
| `message`         | String | A human-readable message describing the event.                              |
| `organization_id` | String | The Better Stack ID of the organization the event originated from.          |
| `team_id`         | String | The Better Stack ID of the team the event originated from.                  |

---

### Monitor Events

Events related to your uptime monitors.

#### `monitor.created`

Triggered when a monitor is created.

```json
[label Example Payload: Monitor Created]
{
  "dt": "2026-05-13T10:05:00.000Z",
  "event": "monitor.created",
  "message": "Monitor \"My Website\" created",
  "organization_id": "org_123",
  "team_id": "team_456",
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}
```

| Field          | Type    | Description                                              |
| :------------- | :------ | :------------------------------------------------------- |
| `monitor_id`   | Integer | The ID of the monitor.                                   |
| `monitor_url`  | String  | The URL being monitored.                                 |
| `monitor_name` | String  | The name of the monitor.                                 |
| `monitor_type` | String  | The type of monitor (e.g., `status`, `keyword`, `ping`). |

#### `monitor.destroyed`

Triggered when a monitor is deleted.

```json
[label Example Payload: Monitor Destroyed]
{
  "dt": "2026-05-13T10:10:00.000Z",
  "event": "monitor.destroyed",
  "message": "Monitor \"My Website\" destroyed",
  "organization_id": "org_123",
  "team_id": "team_456",
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}
```

| Field          | Type    | Description                                              |
| :------------- | :------ | :------------------------------------------------------- |
| `monitor_id`   | Integer | The ID of the monitor.                                   |
| `monitor_url`  | String  | The URL being monitored.                                 |
| `monitor_name` | String  | The name of the monitor.                                 |
| `monitor_type` | String  | The type of monitor (e.g., `status`, `keyword`, `ping`). |

#### `monitor.down`

Triggered when a monitor goes down.

```json
[label Example Payload: Monitor Down]
{
  "dt": "2026-05-13T10:15:00.000Z",
  "event": "monitor.down",
  "message": "Monitor \"My Website\" is down — Connection refused",
  "organization_id": "org_123",
  "team_id": "team_456",
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status",
  "cause": "Connection refused",
  "regions": ["us-east-1", "eu-central-1"]
}
```

| Field          | Type    | Description                                              |
| :------------- | :------ | :------------------------------------------------------- |
| `monitor_id`   | Integer | The ID of the monitor.                                   |
| `monitor_url`  | String  | The URL being monitored.                                 |
| `monitor_name` | String  | The name of the monitor.                                 |
| `monitor_type` | String  | The type of monitor (e.g., `status`, `keyword`, `ping`). |
| `cause`        | String  | The cause of the downtime.                               |
| `regions`      | Array   | An array of regions reporting the downtime.              |

#### `monitor.paused`

Triggered when a monitor is paused.

```json
[label Example Payload: Monitor Paused]
{
  "dt": "2026-05-13T10:20:00.000Z",
  "event": "monitor.paused",
  "message": "Monitor \"My Website\" paused",
  "organization_id": "org_123",
  "team_id": "team_456",
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}
```

| Field          | Type    | Description                                              |
| :------------- | :------ | :------------------------------------------------------- |
| `monitor_id`   | Integer | The ID of the monitor.                                   |
| `monitor_url`  | String  | The URL being monitored.                                 |
| `monitor_name` | String  | The name of the monitor.                                 |
| `monitor_type` | String  | The type of monitor (e.g., `status`, `keyword`, `ping`). |

#### `monitor.unpaused`

Triggered when a monitor is unpaused.

```json
[label Example Payload: Monitor Unpaused]
{
  "dt": "2026-05-13T10:25:00.000Z",
  "event": "monitor.unpaused",
  "message": "Monitor \"My Website\" unpaused",
  "organization_id": "org_123",
  "team_id": "team_456",
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}
```

| Field          | Type    | Description                                              |
| :------------- | :------ | :------------------------------------------------------- |
| `monitor_id`   | Integer | The ID of the monitor.                                   |
| `monitor_url`  | String  | The URL being monitored.                                 |
| `monitor_name` | String  | The name of the monitor.                                 |
| `monitor_type` | String  | The type of monitor (e.g., `status`, `keyword`, `ping`). |

#### `monitor.verifying_recovery`

Triggered when a monitor is verifying recovery.

```json
[label Example Payload: Monitor Verifying Recovery]
{
  "dt": "2026-05-13T10:30:00.000Z",
  "event": "monitor.verifying_recovery",
  "message": "Monitor \"My Website\" is verifying recovery",
  "organization_id": "org_123",
  "team_id": "team_456",
  "monitor_id": 789,
  "monitor_url": "https://www.example.com",
  "monitor_name": "My Website",
  "monitor_type": "status"
}
```

| Field          | Type    | Description                                              |
| :------------- | :------ | :------------------------------------------------------- |
| `monitor_id`   | Integer | The ID of the monitor.                                   |
| `monitor_url`  | String  | The URL being monitored.                                 |
| `monitor_name` | String  | The name of the monitor.                                 |
| `monitor_type` | String  | The type of monitor (e.g., `status`, `keyword`, `ping`). |

---

### Heartbeat Events

Events related to your heartbeats.

#### `heartbeat.created`

Triggered when a heartbeat is created.

```json
[label Example Payload: Heartbeat Created]
{
  "dt": "2026-05-13T11:05:00.000Z",
  "event": "heartbeat.created",
  "message": "Heartbeat \"Daily Backup\" created",
  "organization_id": "org_123",
  "team_id": "team_456",
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}
```

| Field          | Type    | Description                      |
| :------------- | :------ | :------------------------------- |
| `heartbeat_id` | Integer | The ID of the heartbeat.         |
| `heartbeat_name` | String  | The name of the heartbeat.       |

#### `heartbeat.destroyed`

Triggered when a heartbeat is deleted.

```json
[label Example Payload: Heartbeat Destroyed]
{
  "dt": "2026-05-13T11:10:00.000Z",
  "event": "heartbeat.destroyed",
  "message": "Heartbeat \"Daily Backup\" destroyed",
  "organization_id": "org_123",
  "team_id": "team_456",
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}
```

| Field          | Type    | Description                      |
| :------------- | :------ | :------------------------------- |
| `heartbeat_id` | Integer | The ID of the heartbeat.         |
| `heartbeat_name` | String  | The name of the heartbeat.       |

#### `heartbeat.down`

Triggered when a heartbeat goes down (missed).

```json
[label Example Payload: Heartbeat Down]
{
  "dt": "2026-05-13T11:15:00.000Z",
  "event": "heartbeat.down",
  "message": "Heartbeat \"Daily Backup\" is down",
  "organization_id": "org_123",
  "team_id": "team_456",
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}
```

| Field          | Type    | Description                      |
| :------------- | :------ | :------------------------------- |
| `heartbeat_id` | Integer | The ID of the heartbeat.         |
| `heartbeat_name` | String  | The name of the heartbeat.       |

#### `heartbeat.paused`

Triggered when a heartbeat is paused.

```json
[label Example Payload: Heartbeat Paused]
{
  "dt": "2026-05-13T11:20:00.000Z",
  "event": "heartbeat.paused",
  "message": "Heartbeat \"Daily Backup\" paused",
  "organization_id": "org_123",
  "team_id": "team_456",
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}
```

| Field          | Type    | Description                      |
| :------------- | :------ | :------------------------------- |
| `heartbeat_id` | Integer | The ID of the heartbeat.         |
| `heartbeat_name` | String  | The name of the heartbeat.       |

#### `heartbeat.unpaused`

Triggered when a heartbeat is unpaused.

```json
[label Example Payload: Heartbeat Unpaused]
{
  "dt": "2026-05-13T11:25:00.000Z",
  "event": "heartbeat.unpaused",
  "message": "Heartbeat \"Daily Backup\" unpaused",
  "organization_id": "org_123",
  "team_id": "team_456",
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}
```

| Field          | Type    | Description                      |
| :------------- | :------ | :------------------------------- |
| `heartbeat_id` | Integer | The ID of the heartbeat.         |
| `heartbeat_name` | String  | The name of the heartbeat.       |

#### `heartbeat.up`

Triggered when a heartbeat comes back up.

```json
[label Example Payload: Heartbeat Up]
{
  "dt": "2026-05-13T11:30:00.000Z",
  "event": "heartbeat.up",
  "message": "Heartbeat \"Daily Backup\" is up",
  "organization_id": "org_123",
  "team_id": "team_456",
  "heartbeat_id": 101,
  "heartbeat_name": "Daily Backup"
}
```

| Field          | Type    | Description                      |
| :------------- | :------ | :------------------------------- |
| `heartbeat_id` | Integer | The ID of the heartbeat.         |
| `heartbeat_name` | String  | The name of the heartbeat.       |

---

### Incident Events

Events related to incidents.

#### `incident.acknowledged`

Triggered when an incident is acknowledged.

```json
[label Example Payload: Incident Acknowledged]
{
  "dt": "2026-05-13T12:00:00.000Z",
  "event": "incident.acknowledged",
  "message": "Incident \"My Website is Down\" acknowledged by user@example.com",
  "organization_id": "org_123",
  "team_id": "team_456",
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "user_email": "user@example.com",
  "user_name": "John Doe",
  "integration_name": null,
  "integration_type": null
}
```

| Field              | Type    | Description                                              |
| :----------------- | :------ | :------------------------------------------------------- |
| `incident_id`      | Integer | The ID of the incident.                                  |
| `incident_name`    | String  | The name of the incident.                                |
| `resource_type`    | String  | The type of resource causing the incident (e.g., `monitor`, `heartbeat`). |
| `resource_id`      | Integer | The ID of the resource causing the incident.             |
| `resource_name`    | String  | The name of the resource causing the incident.           |
| `user_email`       | String  | The email of the user who acknowledged the incident (if applicable). |
| `user_name`        | String  | The name of the user who acknowledged the incident (if applicable). |
| `integration_name` | String  | The name of the integration that acknowledged the incident (if applicable). |
| `integration_type` | String  | The type of integration that acknowledged the incident (if applicable). |

#### `incident.destroyed`

Triggered when an incident is deleted.

```json
[label Example Payload: Incident Destroyed]
{
  "dt": "2026-05-13T12:05:00.000Z",
  "event": "incident.destroyed",
  "message": "Incident \"My Website is Down\" destroyed",
  "organization_id": "org_123",
  "team_id": "team_456",
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website"
}
```

| Field           | Type    | Description                                              |
| :-------------- | :------ | :------------------------------------------------------- |
| `incident_id`   | Integer | The ID of the incident.                                  |
| `incident_name` | String  | The name of the incident.                                |
| `resource_type` | String  | The type of resource causing the incident.               |
| `resource_id`   | Integer | The ID of the resource causing the incident.             |
| `resource_name` | String  | The name of the resource causing the incident.           |

#### `incident.escalated`

Triggered when an incident is escalated.

```json
[label Example Payload: Incident Escalated]
{
  "dt": "2026-05-13T12:10:00.000Z",
  "event": "incident.escalated",
  "message": "Incident \"My Website is Down\" escalated to John Doe, Operations Team",
  "organization_id": "org_123",
  "team_id": "team_456",
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "escalation_targets": [
    {
      "type": "user",
      "id": 123,
      "name": "John Doe"
    },
    {
      "type": "team",
      "id": 456,
      "name": "Operations Team"
    }
  ]
}
```

| Field              | Type    | Description                                              |
| :----------------- | :------ | :------------------------------------------------------- |
| `incident_id`      | Integer | The ID of the incident.                                  |
| `incident_name`    | String  | The name of the incident.                                |
| `resource_type`    | String  | The type of resource causing the incident.               |
| `resource_id`      | Integer | The ID of the resource causing the incident.             |
| `resource_name`    | String  | The name of the resource causing the incident.           |
| `escalation_targets` | Array   | An array of objects, each describing an escalation target. Each object has `type` (e.g., `user`, `team`), `id`, and `name`. |

#### `incident.grouped`

Triggered when an incident is grouped.

```json
[label Example Payload: Incident Grouped]
{
  "dt": "2026-05-13T12:15:00.000Z",
  "event": "incident.grouped",
  "message": "Incident \"My Website is Down\" grouped into incident group 999",
  "organization_id": "org_123",
  "team_id": "team_456",
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "incident_group_id": 999
}
```

| Field             | Type    | Description                                              |
| :---------------- | :------ | :------------------------------------------------------- |
| `incident_id`     | Integer | The ID of the incident.                                  |
| `incident_name`   | String  | The name of the incident.                                |
| `resource_type`   | String  | The type of resource causing the incident.               |
| `resource_id`     | Integer | The ID of the resource causing the incident.             |
| `resource_name`   | String  | The name of the resource causing the incident.           |
| `incident_group_id` | Integer | The ID of the incident group the incident was added to.  |

#### `incident.reopened`

Triggered when an incident is reopened.

```json
[label Example Payload: Incident Reopened]
{
  "dt": "2026-05-13T12:20:00.000Z",
  "event": "incident.reopened",
  "message": "Incident \"My Website is Down\" reopened by user@example.com",
  "organization_id": "org_123",
  "team_id": "team_456",
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "user_email": "user@example.com",
  "user_name": "John Doe",
  "integration_name": null,
  "integration_type": null
}
```

| Field              | Type    | Description                                              |
| :----------------- | :------ | :------------------------------------------------------- |
| `incident_id`      | Integer | The ID of the incident.                                  |
| `incident_name`    | String  | The name of the incident.                                |
| `resource_type`    | String  | The type of resource causing the incident.               |
| `resource_id`      | Integer | The ID of the resource causing the incident.             |
| `resource_name`    | String  | The name of the resource causing the incident.           |
| `user_email`       | String  | The email of the user who reopened the incident (if applicable). |
| `user_name`        | String  | The name of the user who reopened the incident (if applicable). |
| `integration_name` | String  | The name of the integration that reopened the incident (if applicable). |
| `integration_type` | String  | The type of integration that reopened the incident (if applicable). |

#### `incident.resolved`

Triggered when an incident is resolved.

```json
[label Example Payload: Incident Resolved]
{
  "dt": "2026-05-13T12:25:00.000Z",
  "event": "incident.resolved",
  "message": "Incident \"My Website is Down\" resolved by user@example.com",
  "organization_id": "org_123",
  "team_id": "team_456",
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "user_email": "user@example.com",
  "user_name": "John Doe",
  "integration_name": null,
  "integration_type": null
}
```

| Field              | Type    | Description                                              |
| :----------------- | :------ | :------------------------------------------------------- |
| `incident_id`      | Integer | The ID of the incident.                                  |
| `incident_name`    | String  | The name of the incident.                                |
| `resource_type`    | String  | The type of resource causing the incident.               |
| `resource_id`      | Integer | The ID of the resource causing the incident.             |
| `resource_name`    | String  | The name of the resource causing the incident.           |
| `user_email`       | String  | The email of the user who resolved the incident (if applicable). |
| `user_name`        | String  | The name of the user who resolved the incident (if applicable). |
| `integration_name` | String  | The name of the integration that resolved the incident (if applicable). |
| `integration_type` | String  | The type of integration that resolved the incident (if applicable). |

#### `incident.started`

Triggered when an incident starts.

```json
[label Example Payload: Incident Started]
{
  "dt": "2026-05-13T12:30:00.000Z",
  "event": "incident.started",
  "message": "Incident \"My Website is Down\" started — Connection refused",
  "organization_id": "org_123",
  "team_id": "team_456",
  "incident_id": 201,
  "incident_name": "My Website is Down",
  "resource_type": "monitor",
  "resource_id": 789,
  "resource_name": "My Website",
  "incident_cause": "Connection refused",
  "regions": ["us-east-1", "eu-central-1"],
  "escalation_policy_id": 111
}
```

| Field                | Type    | Description                                              |
| :------------------- | :------ | :------------------------------------------------------- |
| `incident_id`        | Integer | The ID of the incident.                                  |
| `incident_name`      | String  | The name of the incident.                                |
| `resource_type`      | String  | The type of resource causing the incident.               |
| `resource_id`        | Integer | The ID of the resource causing the incident.             |
| `resource_name`      | String  | The name of the resource causing the incident.           |
| `incident_cause`     | String  | The cause of the incident.                               |
| `regions`            | Array   | An array of regions reporting the incident.              |
| `escalation_policy_id` | Integer | The ID of the escalation policy triggered by the incident. |

---