[LiteLLM][Audit Logs] Add audit logs data stream

[muskan-agarwal26]

Proposed commit message

The initial release includes the audit data stream, associated dashboard and visualizations.

The audit data stream collects LiteLLM admin audit logs via two inputs: AWS S3/SQS and the LiteLLM /audit REST API (CEL polling).

LiteLLM fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from live data samples, which were subsequently sanitized.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

To test the LiteLLM package:

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/lite_llm directory.
• Run the following command to run tests.

elastic-package test

2026/07/16 11:22:14  INFO New version is available - v0.125.1. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.125.1
Run system tests for the package
2026/07/16 11:22:15  INFO elastic-package v0.124.0 version-hash 808a6aed (build time: 2026-05-20T20:45:00+05:30)
2026/07/16 11:22:15  INFO elastic-stack: 8.18.0
2026/07/16 11:22:15  INFO Installing package...
2026/07/16 11:22:16  INFO Running test for data_stream "audit" with configuration 'cel'
2026/07/16 11:22:25  INFO Setting up independent Elastic Agent...
2026/07/16 11:22:34  INFO Setting up service...
2026/07/16 11:22:54  INFO Validating test case...
2026/07/16 11:22:55  INFO Tearing down service...
2026/07/16 11:22:56  INFO Write container logs to file: /home/devuser/integrations/build/container-logs/lite_llm-1784181176048705595.log
2026/07/16 11:22:58  INFO Tearing down agent...
2026/07/16 11:22:58  INFO Write container logs to file: /home/devuser/integrations/build/container-logs/elastic-agent-1784181178653101586.log
2026/07/16 11:23:12  INFO Running test for data_stream "audit" with configuration 'aws'
2026/07/16 11:23:20  INFO Setting up independent Elastic Agent...
2026/07/16 11:23:34  INFO Setting up service...
2026/07/16 11:25:58  INFO Validating test case...
2026/07/16 11:25:58  INFO Tearing down service...
2026/07/16 11:27:14  INFO Write container logs to file: /home/devuser/integrations/build/container-logs/lite_llm-1784181434703861130.log
2026/07/16 11:27:17  INFO Tearing down agent...
2026/07/16 11:27:17  INFO Write container logs to file: /home/devuser/integrations/build/container-logs/elastic-agent-1784181437431942466.log
2026/07/16 11:27:33  INFO Uninstalling package...
--- Test results for package: lite_llm - START ---
╭──────────┬─────────────┬───────────┬───────────┬────────┬─────────────────╮
│ PACKAGE  │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │    TIME ELAPSED │
├──────────┼─────────────┼───────────┼───────────┼────────┼─────────────────┤
│ lite_llm │ audit       │ system    │ aws       │ PASS   │ 2m46.633578426s │
│ lite_llm │ audit       │ system    │ cel       │ PASS   │   38.422897929s │
╰──────────┴─────────────┴───────────┴───────────┴────────┴─────────────────╯
--- Test results for package: lite_llm - END   ---
Done
elastic-package test pipeline
Run pipeline tests for the package
2026/07/16 11:30:02  INFO elastic-package v0.125.1 version-hash 111636ab (build time: 2026-07-03T17:56:06+05:30)
2026/07/16 11:30:02  INFO elastic-stack: 8.18.0
--- Test results for package: lite_llm - START ---
╭──────────┬─────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE  │ DATA STREAM │ TEST TYPE │ TEST NAME                                 │ RESULT │ TIME ELAPSED │
├──────────┼─────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤
│ lite_llm │ audit       │ pipeline  │ (ingest pipeline warnings test-audit.log) │ PASS   │ 287.018446ms │
│ lite_llm │ audit       │ pipeline  │ test-audit.log                            │ PASS   │ 310.190233ms │
╰──────────┴─────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: lite_llm - END   ---
Done
elastic-package test static  
Run static tests for the package
2026/07/16 11:30:35  INFO elastic-package v0.125.1 version-hash 111636ab (build time: 2026-07-03T17:56:06+05:30)
--- Test results for package: lite_llm - START ---
╭──────────┬─────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE  │ DATA STREAM │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├──────────┼─────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ lite_llm │ audit       │ static    │ Verify sample_event.json │ PASS   │ 190.224205ms │
╰──────────┴─────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: lite_llm - END   ---
Done
elastic-package test asset 
Run asset tests for the package
2026/07/16 11:30:49  INFO elastic-package v0.125.1 version-hash 111636ab (build time: 2026-07-03T17:56:06+05:30)
2026/07/16 11:30:49  INFO elastic-stack: 8.18.0
--- Test results for package: lite_llm - START ---
╭──────────┬─────────────┬───────────┬───────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE  │ DATA STREAM │ TEST TYPE │ TEST NAME                                                         │ RESULT │ TIME ELAPSED │
├──────────┼─────────────┼───────────┼───────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ lite_llm │             │ asset     │ dashboard lite_llm-7f3c2a1e-9b4d-4c6a-8e2f-1a5b9c3d7e0f is loaded │ PASS   │      1.331µs │
│ lite_llm │ audit       │ asset     │ index_template logs-lite_llm.audit is loaded                      │ PASS   │        320ns │
│ lite_llm │ audit       │ asset     │ ingest_pipeline logs-lite_llm.audit-0.1.0 is loaded               │ PASS   │        183ns │
╰──────────┴─────────────┴───────────┴───────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: lite_llm - END   ---
Done

Related issues

• Relates: [New Integration] LiteLLM #19412

Screenshots

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 3 warnings, 1 suggestion found

⚠️ Warnings (3): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/lite_llm/manifest.yml	135	Elastic.DontUse	Don't use 'Please'.
packages/lite_llm/manifest.yml	178	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/lite_llm/manifest.yml	194	Elastic.DontUse	Don't use 'Please'.

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/lite_llm/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: e193c27

Failed CI Steps

• Check integrations lite_llm

History