Audit log field reference

GitHub 来源:OpenSearch 浏览 115 扫码分享 2023-03-06 19:57:57

Audit log field reference

Audit log field reference

This page contains descriptions for all audit log fields.

Common attributes

The following attributes are logged for all event categories, independent of the layer.

Name	Description
`audit_format_version`	The audit log message format version.
`audit_category`	The audit log category. FAILED_LOGIN, MISSING_PRIVILEGES, BAD_HEADERS, SSL_EXCEPTION, OPENSEARCH_SECURITY_INDEX_ATTEMPT, AUTHENTICATED, or GRANTED_PRIVILEGES.
`audit_node_id`	The ID of the node where the event was generated.
`audit_node_name`	The name of the node where the event was generated.
`audit_node_host_address`	The host address of the node where the event was generated.
`audit_node_host_name`	The host name of the node where the event was generated.
`audit_request_layer`	The layer on which the event has been generated, either TRANSPORT or REST.
`audit_request_origin`	The layer from which the event originated, either TRANSPORT or REST.
`audit_request_effective_user_is_admin`	True if the request was made with a TLS admin certificate, otherwise false.

REST FAILED_LOGIN attributes

Name	Description
`audit_request_effective_user`	The username that failed to authenticate.
`audit_rest_request_path`	The REST endpoint URI.
`audit_rest_request_params`	The HTTP request parameters, if any.
`audit_rest_request_headers`	The HTTP headers, if any.
`audit_request_initiating_user`	The user that initiated the request. Only logged if it differs from the effective user.
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).

REST AUTHENTICATED attributes

Name	Description
`audit_request_effective_user`	The username that failed to authenticate.
`audit_request_initiating_user`	The user that initiated the request. Only logged if it differs from the effective user.
`audit_rest_request_path`	The REST endpoint URI.
`audit_rest_request_params`	The HTTP request parameters, if any.
`audit_rest_request_headers`	The HTTP headers, if any.
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).

REST SSL_EXCEPTION attributes

Name	Description
`audit_request_exception_stacktrace`	The stack trace of the SSL exception.

REST BAD_HEADERS attributes

Name	Description
`audit_rest_request_path`	The REST endpoint URI.
`audit_rest_request_params`	The HTTP request parameters, if any.
`audit_rest_request_headers`	The HTTP headers, if any.
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).

Transport FAILED_LOGIN attributes

Name	Description
`audit_trace_task_id`	The ID of the request.
`audit_transport_headers`	The headers of the request, if any.
`audit_request_effective_user`	The username that failed to authenticate.
`audit_request_initiating_user`	The user that initiated the request. Only logged if it differs from the effective user.
`audit_transport_request_type`	The type of request (e.g. `IndexRequest`).
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).
`audit_trace_indices`	The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if `resolve_indices` is true.
`audit_trace_resolved_indices`	The resolved index name(s) affected by the request. Only logged if `resolve_indices` is true.
`audit_trace_doc_types`	The document types affected by the request. Only logged if `resolve_indices` is true.

Transport AUTHENTICATED attributes

Name	Description
`audit_trace_task_id`	The ID of the request.
`audit_transport_headers`	The headers of the request, if any.
`audit_request_effective_user`	The username that failed to authenticate.
`audit_request_initiating_user`	The user that initiated the request. Only logged if it differs from the effective user.
`audit_transport_request_type`	The type of request (e.g. `IndexRequest`).
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).
`audit_trace_indices`	The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if `resolve_indices` is true.
`audit_trace_resolved_indices`	The resolved index name(s) affected by the request. Only logged if `resolve_indices` is true.
`audit_trace_doc_types`	The document types affected by the request. Only logged if `resolve_indices` is true.

Transport MISSING_PRIVILEGES attributes

Name	Description
`audit_trace_task_id`	The ID of the request.
`audit_trace_task_parent_id`	The parent ID of this request, if any.
`audit_transport_headers`	The headers of the request, if any.
`audit_request_effective_user`	The username that failed to authenticate.
`audit_request_initiating_user`	The user that initiated the request. Only logged if it differs from the effective user.
`audit_transport_request_type`	The type of request (e.g. `IndexRequest`).
`audit_request_privilege`	The required privilege of the request (e.g. `indices:data/read/search`).
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).
`audit_trace_indices`	The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if `resolve_indices` is true.
`audit_trace_resolved_indices`	The resolved index name(s) affected by the request. Only logged if `resolve_indices` is true.
`audit_trace_doc_types`	The document types affected by the request. Only logged if `resolve_indices` is true.

Transport GRANTED_PRIVILEGES attributes

Name	Description
`audit_trace_task_id`	The ID of the request.
`audit_trace_task_parent_id`	The parent ID of this request, if any.
`audit_transport_headers`	The headers of the request, if any.
`audit_request_effective_user`	The username that failed to authenticate.
`audit_request_initiating_user`	The user that initiated the request. Only logged if it differs from the effective user.
`audit_transport_request_type`	The type of request (e.g. `IndexRequest`).
`audit_request_privilege`	The required privilege of the request (e.g. `indices:data/read/search`).
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).
`audit_trace_indices`	The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if `resolve_indices` is true.
`audit_trace_resolved_indices`	The resolved index name(s) affected by the request. Only logged if `resolve_indices` is true.
`audit_trace_doc_types`	The document types affected by the request. Only logged if `resolve_indices` is true.

Transport SSL_EXCEPTION attributes

Name	Description
`audit_request_exception_stacktrace`	The stack trace of the SSL exception.

Transport BAD_HEADERS attributes

Name	Description
`audit_trace_task_id`	The ID of the request.
`audit_trace_task_parent_id`	The parent ID of this request, if any.
`audit_transport_headers`	The headers of the request, if any.
`audit_request_effective_user`	The username that failed to authenticate.
`audit_request_initiating_user`	The user that initiated the request. Only logged if it differs from the effective user.
`audit_transport_request_type`	The type of request (e.g. `IndexRequest`).
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).
`audit_trace_indices`	The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if `resolve_indices` is true.
`audit_trace_resolved_indices`	The resolved index name(s) affected by the request. Only logged if `resolve_indices` is true.
`audit_trace_doc_types`	The document types affected by the request. Only logged if `resolve_indices` is true.

Transport opensearch_SECURITY_INDEX_ATTEMPT attributes

Name	Description
`audit_trace_task_id`	The ID of the request.
`audit_transport_headers`	The headers of the request, if any.
`audit_request_effective_user`	The username that failed to authenticate.
`audit_request_initiating_user`	The user that initiated the request. Only logged if it differs from the effective user.
`audit_transport_request_type`	The type of request (e.g. `IndexRequest`).
`audit_request_body`	The HTTP request body, if any (and if request body logging is enabled).
`audit_trace_indices`	The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if `resolve_indices` is true.
`audit_trace_resolved_indices`	The resolved index name(s) affected by the request. Only logged if `resolve_indices` is true.
`audit_trace_doc_types`	The document types affected by the request. Only logged if `resolve_indices` is true.

当前内容版权归 OpenSearch 或其关联方所有，如需对内容或内容相关联开源项目进行关注与资助，请访问 OpenSearch .

本文档使用 BookStack 构建

展开/收起文章目录