Audit1 input → 1 output

Audit Log

Audit logging node for EHRConnect workflows. Captures a snapshot of the message payload, masks sensitive data, and writes a structured entry to AWS CloudWatch — without blocking the flow.

Inputs

payload any: The message payload to audit. Accepts any value — objects, arrays, strings, or primitives. Passed through to the output unchanged.
_msgid string: Node-RED message ID, automatically included in the log entry for traceability.

Outputs

payload any: The original input payload, forwarded immediately and unchanged. Masking is applied only to the log copy — the live message is never modified.

Details

This node captures a snapshot of the message at any point in the flow and logs it to CloudWatch asynchronously. Because logging runs in the background (setImmediate), it never delays downstream nodes.

Masking is applied to the log copy only. The following layers are applied in order when auto-masking is enabled:

Full redaction — tokens, passwords, secrets, SSN, payment fields replaced with [REDACTED]
Partial masking — names, emails, phone numbers, patient/member IDs show first 4 chars + ****
UUID detection — any value matching UUID format is masked regardless of field name
Custom fields — user-defined field names from Fields to Mask, always applied even when auto-masking is off

Logs are written to CloudWatch log group /audit as structured JSON with a workflow.audit event type.

Configuration

Name string: Display name shown on the canvas node.
Log Label string: Optional free-text tag included in every log entry — useful for filtering in CloudWatch Insights (e.g., After FHIR Read, Pre-Transform).
Fields to Mask tags: Additional field names from msg.payload to mask. Press Enter or , to add. Always active regardless of the auto-masking toggle.
Enable auto-masking boolean: When checked (default), built-in masking rules for tokens, passwords, PHI, and UUIDs are applied automatically. Uncheck to disable built-in rules and rely only on Fields to Mask.

Examples

Basic audit placement in a FHIR flow:

┌──────────┐   ┌─────────────┐   ┌───────────┐   ┌──────────┐
│ Auth     │──▶│ FHIR Read   │──▶│ Audit Log │──▶│ Process  │
│ Backend  │   │ (Patient)   │   │           │   │ Resource │
└──────────┘   └─────────────┘   └───────────┘   └──────────┘

Input message (passed through unchanged):

msg.payload = {
    "resourceType": "Patient",
    "id": "abc-123",
    "name": [{ "family": "Smith", "given": ["John"] }],
    "access_token": "eyJhbGci..."
};

What gets logged to CloudWatch (auto-masking on):

{
    "timestamp": "2026-04-14T10:23:45.000Z",
    "type": "workflow.audit",
    "source": { "nodeName": "Audit Log", "label": "After FHIR Read" },
    "payload": {
        "resourceType": "Patient",
        "id": "abc1**",
        "name": [{ "family": "Smit****", "given": ["John****"] }],
        "access_token": "eyJhbGc...[REDACTED]...iJ9"
    }
}

Best Practices

Place this node at key checkpoints — after auth, before/after transforms, on error paths
Use the Log Label field to make CloudWatch Insights queries easier
Add custom Fields to Mask for domain-specific identifiers like policyNumber, referralCode
Keep auto-masking enabled in production — only disable for local debugging
Logs are written to CloudWatch log group /audit

┌──────────┐ ┌─────────────┐ ┌───────────┐ ┌──────────┐ │ Auth │──▶│ FHIR Read │──▶│ Audit Log │──▶│ Process │ │ Backend │ │ (Patient) │ │ │ │ Resource │ └──────────┘ └─────────────┘ └───────────┘ └──────────┘

{ "timestamp": "2026-04-14T10:23:45.000Z", "type": "workflow.audit", "source": { "nodeName": "Audit Log", "label": "After FHIR Read" }, "payload": { "resourceType": "Patient", "id": "abc1**", "name": [{ "family": "Smit****", "given": ["John****"] }], "access_token": "eyJhbGc...[REDACTED]...iJ9" } }