Search the audit log by pipeline, actor, and subject

Buildkite's audit log search was previously limited to type:, so answering "what happened to this pipeline?" or "what did this person change?" meant paging through everything else that happened in the last 90 days. We've added three more terms to help you find exactly what you're looking for.

• pipeline: returns the events a pipeline is the subject of, by slug or UUID (for example, pipeline:my-app). The slug of a deleted pipeline still resolves, which is how you find the event that recorded the deletion. Events about the pipeline's schedules aren't included, since the schedule is the subject of those.
• actor: returns the events a person performed, by email address or user UUID (for example, actor:sam@example.com). This will also match members who have since been removed from your organization, so losing access doesn't hide what someone did. Only people match, so an event performed by an agent or an API application is neither returned by actor: nor excluded by -actor:.
• subject: returns the events performed on a kind of record (for example, subject:CLUSTER), covering every cluster the way pipeline:my-app covers a single pipeline.

Every term is negatable with a - prefix, and they combine the way type: already did: up to three terms, repeating a key to match any of its values, mixing keys to match all of them. So type:PIPELINE_UPDATED pipeline:my-app returns the configuration changes made to one pipeline, and subject:SECRET -actor:sam@example.com returns everything done to a secret by someone other than Sam.

Alongside the existing event type list, Browse available subjects below the search bar lists the subjects you can filter on and adds one to the query when you click it.

We've also improved error handling for invalid searches. A query the search couldn't understand used to be ignored, which returned every event in the window and looked like a filter that had matched a lot. Free text, an unsupported term, and a term with no value now report the problem instead. A misspelled event type or subject names the closest match, so type:PIPLINE_UPDATED answers with Unknown event type "PIPLINE_UPDATED". Did you mean PIPELINE_UPDATED?, and a pipeline slug or email address that matches nothing is reported the same way.