Export Kestra audit logs as a CSV file and send out via Email.

Turn Kestra Enterprise Edition audit logs into a shareable, scheduled compliance report. This blueprint collects audit log events from the last day, exports them as a flat CSV file, and emails that file as an attachment so security, compliance, and platform teams get a recurring record of who did what inside Kestra without anyone logging into the UI. It solves the common governance problem of audit data sitting locked inside the platform: instead of manual exports, you get an automated, auditable, repeatable weekly delivery.

How it works

1. A io.kestra.plugin.core.trigger.Schedule trigger fires on the cron 0 10 * * 5, which is every Friday at 10:00 UTC.
2. The ship_audit_logs task (io.kestra.plugin.ee.core.log.AuditLogShipper) collects audit log events using a lookbackPeriod of P1D and routes them through a FileLogExporter, writing the events to internal storage as an Ion file.
3. The convert_to_csv task (io.kestra.plugin.serdes.csv.IonToCsv) reads the first exported file URI ({{ outputs.ship_audit_logs.outputs.file.uris | first }}) and converts the Ion data into a CSV file.
4. The send_email task (io.kestra.plugin.email.MailSend) sends an email through an SMTP server (mail.privateemail.com, port 465) with the CSV attached as audit_logs.csv and a text/csv content type.

What you get

• A scheduled, hands-off weekly audit log export with no manual UI exports.
• A clean, spreadsheet-friendly CSV instead of raw Ion or JSON.
• The report delivered straight to an inbox or distribution list as an attachment.
• A consistent governance and compliance artifact you can archive.

Who it's for

• Security and compliance teams tracking activity and access.
• Platform and DevOps engineers running Kestra Enterprise Edition.
• Administrators who need a recurring, evidence-grade record of platform actions.

Why orchestrate this with Kestra

Kestra ships audit logs as a first-class Enterprise feature, but shipping them is only half the job. With Kestra you wire the export, the format conversion, and the delivery into one declarative YAML flow. The Schedule trigger replaces brittle external cron jobs, retries keep the export resilient if the SMTP server or storage hiccups, and execution history gives you full lineage of every run. A standalone log exporter cannot convert Ion to CSV and email the result in the same governed pipeline: Kestra closes that gap end to end.

Prerequisites

• Kestra Enterprise Edition (the AuditLogShipper and FileLogExporter tasks are EE only).
• An SMTP account reachable at the configured host and port.

Secrets

• EMAIL_USERNAME: the SMTP username for the sending mailbox.
• EMAIL_PASSWORD: the SMTP password or app password.

Quick start

1. Add the EMAIL_USERNAME and EMAIL_PASSWORD secrets to your Kestra instance.
2. Update the from, to, host, and port properties on send_email to match your mail provider.
3. Adjust the cron expression on the schedule trigger if you want a different cadence or timezone.
4. Save the flow and let the schedule run, or trigger an execution manually to test.

How to extend

• Change lookbackPeriod to P7D for a weekly window or PT1H for hourly exports.
• Swap IonToCsv for io.kestra.plugin.serdes.json.IonToJson or an Excel writer to change the output format.
• Replace the email step with a gcs.Upload, s3.Upload, or Slack notification to route logs elsewhere.
• Add a downstream task to load the CSV into a warehouse such as BigQuery or Snowflake for long-term analysis.

Links

• Audit logs documentation
• SerDes plugin
• Email plugin