---
title: ZooKeeper fields
description: ZooKeeper Module ZooKeeper Audit logs. ZooKeeper logs. 
url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/beats/filebeat/exported-fields-zookeeper
products:
  - Beats
  - Filebeat
applies_to:
  - Elastic Cloud Serverless: Beta
  - Elastic Stack: Beta
---

# ZooKeeper fields
ZooKeeper Module

## zookeeper


## audit

<applies-to>
  - Elastic Stack: Beta
</applies-to>

ZooKeeper Audit logs.
<definitions>
  <definition term="zookeeper.audit.session">
    Client session id
    type: keyword
  </definition>
  <definition term="zookeeper.audit.znode">
    Path of the znode
    type: keyword
  </definition>
  <definition term="zookeeper.audit.znode_type">
    Type of znode in case of creation operation
    type: keyword
  </definition>
  <definition term="zookeeper.audit.acl">
    String representation of znode ACL like cdrwa(create, delete,read, write, admin). This is logged only for setAcl operation
    type: keyword
  </definition>
  <definition term="zookeeper.audit.result">
    Result of the operation. Possible values are (success/failure/invoked). Result "invoked" is used for serverStop operation because stop is logged before ensuring that server actually stopped.
    type: keyword
  </definition>
  <definition term="zookeeper.audit.user">
    Comma separated list of users who are associate with a client session
    type: keyword
  </definition>
</definitions>


## log

<applies-to>
  - Elastic Stack: Beta
</applies-to>

ZooKeeper logs.