Security Event Format & Query Reference
Routewarden emits structured JSON events from all gateway plugins (Traefik, Caddy, NGINX, and TCP Warden). These events are normalized into Apache/Nginx Combined log format when ingested by the dashboard.
{ "time": "2026-10-17T23:45:10Z", "client_ip": "203.0.113.195", "verdict": "BLOCK", "method": "GET", "path": "/.env", "rule": "BlockDotEnv", "status": 403, "latency_ms": 0.42}Event Schema Specification
| Field | Type | Description |
|---|---|---|
time | string (RFC3339) | Timestamp when the request reached the gateway |
client_ip | string | Offender client IP address (resolved via trustedProxies) |
verdict | string | Enforcement action: BLOCK, ALLOW, or TARPIT |
method | string | HTTP method: GET, POST, PUT, DELETE, etc. |
path | string | Normalized request path evaluated by the engine |
rule | string | Name or ID of the matched security rule |
status | int | HTTP status code returned to the client (403, 429, 200) |
latency_ms | float | Inspection latency incurred by the Routewarden plugin |
CLI Filtering Flags
The rwarden monitor command supports real-time stream filtering:
| Flag | Argument | Description |
|---|---|---|
--verdict | BLOCK / ALLOW / TARPIT | Show only events matching the verdict |
--ip | <substring> | Filter events matching a client IP or subnet |
--path | <substring> | Filter events targeting a specific path prefix |
--raw | boolean | Output raw lines for direct Unix piping |