Sure, but I just wanted to clarify: do you mean just in the message or the whole event?

The reason I ask is that eventually, the user will be able to see a history of their actions, and can draw from that full history that the pending server is on a group that is already deleted.  The audit log is sort of a bottom layer, and probably some other consolidating layer (maybe in reach) should aggregate the logs into a nicer form, maybe by tree.  And the message is meant to be mostly meaningless then - only human readable when they're parsing the JSON.  The important part is that all the other structured data is available for the layer above to construct more useful messages.

So I'm all for putting more detail in to the `_message` since there currently isn't an alternative.  I'm not sure it needs to be a separate event type though (pending due to pending job cancellation, pending due to pending job cancellation due to group deletion), since they're basically the same event, just have a different cause (which is reflected by the transaction ids, the scaling group, other structured info).