goauthentik · GirlBossRush · Aug 19, 2025
@@ -17,7 +17,7 @@ To try out the release candidate, replace your Docker image tag with the latest
 
 ![Screenshot of the admin interface showing events plotted on a histogram chart and on a map](../../sys-mgmt/events/event-map-chart.png)
 
-- **Advanced search**: :ak-enterprise Search for [users](../../users-sources/user/user_basic_operations.md#tell-me-more) and [event logs](../../sys-mgmt/events/logging-events.md#tell-me-more) with custom query language to filter on their properties and attributes.
+- **Advanced search**: :ak-enterprise Search for [users](../../users-sources/user/user_basic_operations.md#tell-me-more) and [event logs](../../sys-mgmt/events/logging-events.mdx#tell-me-more) with custom query language to filter on their properties and attributes.
 
 - **Email stage rate limiting**: The email stage can now be configured to set a maximum number of emails that can be sent within a specified time period.
 

@@ -14,7 +14,7 @@ Events can be used to define [notification rules](notifications.md), with specif
 
 Event logging in authentik provides several layers of transparency about user and system actions, from a quick view on the Overview dashboard, to a full, searchable list of all events, with a volume graph to highlight any spikes, in the Admin interface under **Events > Logs**.
 
-Refer to our [Logging documentation](./logging-events.md) for more information.
+Refer to our [Logging documentation](./logging-events.mdx) for more information.
 
 ## Event retention and forwarding
 

@@ -2,6 +2,8 @@
 title: Logging events
 ---
 
+import { KeyBindingsTable } from "@goauthentik/docusaurus-theme/components/KeyBindingsTable";
+
 Logs are a vital tool for system diagnostics, event auditing, user management, reporting, and more. They capture detailed information about each event including the client's IP address, the user involved, the date and time, and the specific action taken.
 
 Event logging in authentik is highly configurable. You can set the [retention period](./index.md#event-retention-and-forwarding) for storing and displaying events, specify which events should trigger a [notification](./notifications.md), and access low-level details about when and where each event occurred.
@@ -42,20 +44,66 @@ You can construct advanced queries to find specific event logs. In the Admin int
 
 - **Values**: `True`, `False`, `None`, and more
 
-- **Example queries**:
-    - search event by application name: `app startswith "N"`
-    - search event by action: `action = "login"`
-    - search event by authorized application context: `authorized_application.name = "My app"`
-    - search event by country: `context.geo.country = "Germany"`
-    - search event by IP address: `client_ip = "10.0.0.1"`
-    - search event by brand: `brand.name = "my brand"`
-    - search event by user: `user.username in ["ana", "akadmin"]`
+### Keyboard Interactions
+
+<KeyBindingsTable
+    aria-label="Keyboard shortcuts for the Query Language (QL) search"
+
+    bindings={[
+        [
+            "Autocomplete",
+            [
+                ["Select next suggestion", <kbd aria-label="Down arrow">↓</kbd>],
+                ["Select previous suggestion", <kbd aria-label="Up arrow">↑</kbd>],
+                ["Accept the current suggestion", <kbd aria-label="Enter key">Enter</kbd>],
+                ["Dismiss suggestions", <kbd aria-label="Escape key">ESC</kbd>],
+            ],
+        ],
+        [
+            "Search",
+            [
+                ["Submit the current query", <kbd aria-label="Enter key">Enter</kbd>],
+                ["Clear the current query", <kbd aria-label="Escape key">ESC</kbd>],
+            ],
+        ],
+    ]}
+
+/>
+
+### Example queries
+
+```sh title="Search event by application name"
+app startswith "N"
+```
+
+```sh title="Search event by action"
+action = "login"
+```
+
+```sh title="Search event by authorized application context"
+authorized_application.name = "My app"
+```
+
+```sh title="Search event by country"
+context.geo.country = "Germany"
+```
+
+```sh title="Search event by IP address"
+client_ip = "10.0.0.1"
+```
+
+```sh title="Search event by brand"
+brand.name = "my brand"
+```
+
+```sh title="Search event by user"
+user.username in ["ana", "akadmin"]
+```
 
 For more examples, refer to the list of [Event actions](./event-actions.md) and the related examples for each type of event.
 
 :::info
 
-1. To dismiss the drop-down menu option, click **ESC**.
-2. If the list of operators does not appear in a drop-down menu you will need to manually enter it.
-3. For queries that include `user`, `brand`, or `context` you need to use a compound term such as `user.username` or `brand.name`.
+1. If the list of operators does not appear in a drop-down menu you will need to manually enter it.
+2. For queries that include `user`, `brand`, or `context` you need to use a compound term such as `user.username` or `brand.name`.
    :::
@@ -0,0 +1,42 @@
+import styles from "./styles.module.css";
+
+export type KeyBindingGroup = [label: React.ReactNode, bindings: KeyBinding[]];
+
+export type KeyBinding = [label: React.ReactNode, key: React.ReactNode];
+
+export interface KeyBindingsTableProps extends React.HTMLAttributes<HTMLTableElement> {
+    bindings?: KeyBindingGroup[];
+}
+
+export const KeyBindingsTable: React.FC<KeyBindingsTableProps> = ({ bindings = [], ...props }) => {
+    return (
+        <table className={styles.table} {...props}>
+            <thead>
+                <tr>
+                    <th className={styles.actionColumn} scope="col" id="key-col-action">
+                        Action
+                    </th>
+                    <th className={styles.bindingColumn} scope="col" id="key-col-binding">
+                        Key Binding
+                    </th>
+                </tr>
+            </thead>
+
+            {bindings.map(([label, bindings], groupIndex) => (
+                <tbody key={groupIndex}>
+                    <tr>
+                        <th colSpan={2} scope="rowgroup">
+                            {label}
+                        </th>
+                    </tr>
+                    {bindings.map(([label, key], bindingIndex) => (
+                        <tr key={`${groupIndex}-${bindingIndex}`}>
+                            <td>{label}</td>
+                            <td>{key}</td>
+                        </tr>
+                    ))}
+                </tbody>
+            ))}
+        </table>
+    );
+};
@@ -0,0 +1,55 @@
+.table {
+    width: 100%;
+
+    --ifm-table-border-color: var(--ifm-color-info-contrast-background);
+    --ifm-table-stripe-background: transparent;
+    --ifm-table-stripe-background: var(--ifm-color-emphasis-100);
+
+    thead {
+        background-color: var(--ifm-color-info-contrast-background);
+        text-align: left;
+    }
+
+    tr,
+    td,
+    th {
+        border-color: transparent;
+    }
+
+    tr {
+        th {
+            border-block-end-color: var(--ifm-color-info-contrast-background);
+        }
+
+        td:first-child {
+            text-align: end;
+
+            font-family: var(--ifm-heading-font-family);
+            font-weight: 300;
+            border-inline-end-color: var(--ifm-color-secondary-dark);
+        }
+    }
+
+    tbody tr th {
+        --ifm-table-cell-padding: 0.5rem;
+        font-weight: 600;
+        font-family: var(--ifm-heading-font-family);
+        text-align: end;
+        background-color: transparent;
+    }
+
+    kbd {
+        user-select: none;
+        text-rendering: optimizeLegibility;
+        font-weight: 900;
+        letter-spacing: 0.05em;
+        padding: 0.25rem 0.25rem;
+    }
+    .actionColumn {
+        min-width: 20rem;
+    }
+
+    .bindingColumn {
+        width: 100%;
+    }
+}