OpenSearch/x-pack/qa/sql/security
Albert Zaharovits c86e2d5211
Structured audit logging (#31931)
Changes the format of log events in the audit logfile.
It also changes the filename suffix from `_access` to `_audit`.
The new entry format is consistent with Elastic Common Schema.
Entries are formatted as JSON with no nested objects and field
names have a dotted syntax. Moreover, log entries themselves
are not spaced by commas and there is exactly one entry per line.
In addition, entry fields are ordered, unlike a typical JSON doc,
such that a human would not strain his eyes over jumbled 
fields from one line to the other; the order is defined in the log4j2
properties file.
The implementation utilizes the log4j2's `StringMapMessage`.
This means that the application builds the log event as a map
and the log4j logic (the appender's layout) handle the format
internally. The layout, such as the set of printed fields and their
order, can be changed at runtime without restarting the node.
2018-09-14 15:25:53 +03:00
..
no-ssl Migrate x-pack-elasticsearch source to elasticsearch 2018-04-20 15:29:54 -07:00
src/test Structured audit logging (#31931) 2018-09-14 15:25:53 +03:00
ssl Allow Integ Tests to run in a FIPS-140 JVM (#31989) 2018-07-24 12:48:14 +03:00
build.gradle Structured audit logging (#31931) 2018-09-14 15:25:53 +03:00
roles.yml Add comments inadvertently removed during migrate 2018-04-24 13:41:09 -05:00