Keen documentation
Open Keen ↗

Administering Keen

Redmine issues and journals

Chapter 25 of 30

Redmine ingestion

Redmine is a built-in, read-only REST ingester. It collects current issue snapshots and journal entries (comments and field changes), including closed issues, so ticket work can stand as evidence. Keen performs only GET requests.

Server setup

  1. Enable REST API in Redmine Administration → Settings → API.
  2. Create a dedicated Redmine user with access only to the projects and private notes you intend Keen to retain, and obtain its API key from My account. The key inherits that user's permissions.
  3. Set these in Keen's .env and recreate the API, worker and beat containers:
    KEEN_REDMINE_ENABLED=true
    KEEN_REDMINE_BASE_URL=https://redmine.example.org
    KEEN_REDMINE_API_KEY=YOUR_API_KEY
    KEEN_REDMINE_CONFIG_PATH=/app/config/redmine.yml
    KEEN_REDMINE_POLL_SECONDS=600
    

A path prefix such as https://example.org/redmine is supported. Create a named Redmine connection for each server and credential set and add project inputs to each; the Environment default connection uses the deployment settings.

Going deeper: transport security

Credentials travel in the X-Redmine-API-Key header and stay out of the URL. HTTPS and certificate verification are mandatory, redirects are rejected, requests time out and response bodies are bounded to 8 MiB. The existing Keen ingestion network policy applies, including KEEN_INGESTION_ALLOWED_CIDRS for private networks. There is no option to disable TLS checks.

Select projects in Keen

Define a Redmine source with its URL and API key, then select Add input on that source in Sources & evidence mapping. Choose projects and enter:

An optional label becomes the event's system; otherwise it is the project's identifier. The shipped project list is empty, so enabling the adapter alone collects nothing; add one or more collections, then use Ingest runners → Run Redmine or wait for the scheduled run. Source-wide mapping definitions do not create collection selections by themselves.

Going deeper: the YAML file and its settings

Administrators can also manage config/redmine.yml; saved web-UI configuration overrides it, so use the UI consistently once an override exists. Shared adapter settings are editable in the source/connection management view.

ui_name: Redmine
badge_color: '#B73939'
projects:
  - project: '*'
    # label: Issue management
include_journals: true
initial_lookback_days: 0
overlap_seconds: 300
max_pages: 1000
full_scan_hours: 24

initial_lookback_days: 0 fetches all existing issues on the first run. A positive number limits that initial selection to recently updated issues, while all accessible journals of those issues are retained, including older comments. This initial lower bound is stored with the project cursor and retained during periodic reconciliation; changing it later does not reset existing cursors.

Going deeper: scans, reconciliation and limits

Incremental scans query issues updated since the previous successful scan, with a five-minute overlap by default. A full reconciliation runs every 24 hours by default, within the recorded history window, and can detect edits to older journals even when an issue's updated timestamp was not changed. Records absent from Redmine are not deleted from Keen, and a polling adapter cannot reconstruct deleted comments or intermediate states that disappeared between polls.

Pagination reads up to 100 records per page. max_pages bounds each project-discovery or issue-list traversal; hitting the limit fails visibly and retains the cursor, so increase it (maximum 10,000) or narrow the selection for very large installations. Initial imports and reconciliation can be expensive: each issue needs a detail request, and large journals also incur artifact and deduplication work. A project permission failure is reported without advancing its cursor while other projects complete; HTTP 429 and transient failures retain the cursor and are retried on the next scheduled run, with no rapid retry loop. Only one run per Redmine URL is allowed at a time.

Map Redmine evidence

Choose Create mapping, source redmine. Leave collection selection broad, or select a configured project collection, and use a real event or structured conditions to refine it.

Event actionMeaning
issue.snapshotCurrent issue state when captured
issue.commentJournal with comment text, possibly including field changes
issue.updatedJournal containing field changes without comment text

All use outcome info: closing a ticket does not automatically prove a security control succeeded. The snapshot actor is unset because the original author may not be the person who made the latest change; the journal actor identifies the journal author, and edits can also expose journal.updated_by.

Example: source redmine, action issue.comment, project identifier equals infrastructure, and journal notes contains patching completed. Name the mapping “Documented patch deployment and review”, then choose the appropriate patch-management controls.

Going deeper: useful JSON paths and historical journals
  • fields["project.identifier"], fields["project.id"], fields["project.name"]
  • fields["issue.id"], fields["issue.subject"]
  • fields["issue.status.name"], fields["issue.tracker.name"]
  • fields["issue.priority.name"], fields["issue.assigned_to.name"]
  • fields["issue.custom_field.12"] (actual Redmine custom-field ID)
  • fields["journal.notes"], fields["journal.private_notes"]
  • fields["change.attr.status_id.changed"] equals true
  • fields["change.attr.status_id.new_value"] equals your resolved status ID

For field-only journals use issue.updated. To include both comments and changes, leave action empty and require the relevant change.*.changed field. Keen's structured fields are ANDed, and status IDs do not have identical meanings across installations.

issue.* is the issue state at capture time, including on historical journal events; the journal's details / change.* fields describe its historical change, so inspect them when mapping a historical transition. Historical comments imported in one scan may share the current issue status, which is not the status at the time each comment was written.

Events retain collection provenance and a link back to the Redmine issue or journal. They use the standard Keen redaction, artifact storage, SHA-256 and framework-rule pipeline, including S3 or immutable retention when configured. Stable content identities suppress repeated unchanged records; edited records produce new evidence versions and earlier artifacts remain. Switching collection selectors does not rewrite old provenance, so use structured project fields to map historical events across such a change.

Scope

This adapter covers projects for discovery and issues and journals for evidence. It does not yet collect wiki pages, time entries, news, memberships, attachment file contents or other Redmine resources. Private content is included only when returned to the configured account, and existing Keen redaction and access policies apply.

Official API documentation: