8.8 KiB
8.8 KiB
layout | title | parent | grand_parent | nav_order |
---|---|---|---|---|
default | Audit Log Field Reference | Audit Logs | Security | 1 |
Audit log field reference
This page contains descriptions for all audit log fields.
Common attributes
The following attributes are logged for all event categories, independent of the layer.
Name | Description |
---|---|
audit_format_version |
The audit log message format version. |
audit_category |
The audit log category. FAILED_LOGIN, MISSING_PRIVILEGES, BAD_HEADERS, SSL_EXCEPTION, OPENSEARCH_SECURITY_INDEX_ATTEMPT, AUTHENTICATED, or GRANTED_PRIVILEGES. |
audit_node_id |
The ID of the node where the event was generated. |
audit_node_name |
The name of the node where the event was generated. |
audit_node_host_address |
The host address of the node where the event was generated. |
audit_node_host_name |
The host name of the node where the event was generated. |
audit_request_layer |
The layer on which the event has been generated, either TRANSPORT or REST. |
audit_request_origin |
The layer from which the event originated, either TRANSPORT or REST. |
audit_request_effective_user_is_admin |
True if the request was made with a TLS admin certificate, otherwise false. |
REST FAILED_LOGIN attributes
Name | Description |
---|---|
audit_request_effective_user |
The username that failed to authenticate. |
audit_rest_request_path |
The REST endpoint URI. |
audit_rest_request_params |
The HTTP request parameters, if any. |
audit_rest_request_headers |
The HTTP headers, if any. |
audit_request_initiating_user |
The user that initiated the request. Only logged if it differs from the effective user. |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
REST AUTHENTICATED attributes
Name | Description |
---|---|
audit_request_effective_user |
The username that failed to authenticate. |
audit_request_initiating_user |
The user that initiated the request. Only logged if it differs from the effective user. |
audit_rest_request_path |
The REST endpoint URI. |
audit_rest_request_params |
The HTTP request parameters, if any. |
audit_rest_request_headers |
The HTTP headers, if any. |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
REST SSL_EXCEPTION attributes
Name | Description |
---|---|
audit_request_exception_stacktrace |
The stack trace of the SSL exception. |
REST BAD_HEADERS attributes
Name | Description |
---|---|
audit_rest_request_path |
The REST endpoint URI. |
audit_rest_request_params |
The HTTP request parameters, if any. |
audit_rest_request_headers |
The HTTP headers, if any. |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
Transport FAILED_LOGIN attributes
Name | Description |
---|---|
audit_trace_task_id |
The ID of the request. |
audit_transport_headers |
The headers of the request, if any. |
audit_request_effective_user |
The username that failed to authenticate. |
audit_request_initiating_user |
The user that initiated the request. Only logged if it differs from the effective user. |
audit_transport_request_type |
The type of request (e.g. IndexRequest ). |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
audit_trace_indices |
The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true. |
audit_trace_resolved_indices |
The resolved index name(s) affected by the request. Only logged if resolve_indices is true. |
audit_trace_doc_types |
The document types affected by the request. Only logged if resolve_indices is true. |
Transport AUTHENTICATED attributes
Name | Description |
---|---|
audit_trace_task_id |
The ID of the request. |
audit_transport_headers |
The headers of the request, if any. |
audit_request_effective_user |
The username that failed to authenticate. |
audit_request_initiating_user |
The user that initiated the request. Only logged if it differs from the effective user. |
audit_transport_request_type |
The type of request (e.g. IndexRequest ). |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
audit_trace_indices |
The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true. |
audit_trace_resolved_indices |
The resolved index name(s) affected by the request. Only logged if resolve_indices is true. |
audit_trace_doc_types |
The document types affected by the request. Only logged if resolve_indices is true. |
Transport MISSING_PRIVILEGES attributes
Name | Description |
---|---|
audit_trace_task_id |
The ID of the request. |
audit_trace_task_parent_id |
The parent ID of this request, if any. |
audit_transport_headers |
The headers of the request, if any. |
audit_request_effective_user |
The username that failed to authenticate. |
audit_request_initiating_user |
The user that initiated the request. Only logged if it differs from the effective user. |
audit_transport_request_type |
The type of request (e.g. IndexRequest ). |
audit_request_privilege |
The required privilege of the request (e.g. indices:data/read/search ). |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
audit_trace_indices |
The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true. |
audit_trace_resolved_indices |
The resolved index name(s) affected by the request. Only logged if resolve_indices is true. |
audit_trace_doc_types |
The document types affected by the request. Only logged if resolve_indices is true. |
Transport GRANTED_PRIVILEGES attributes
Name | Description |
---|---|
audit_trace_task_id |
The ID of the request. |
audit_trace_task_parent_id |
The parent ID of this request, if any. |
audit_transport_headers |
The headers of the request, if any. |
audit_request_effective_user |
The username that failed to authenticate. |
audit_request_initiating_user |
The user that initiated the request. Only logged if it differs from the effective user. |
audit_transport_request_type |
The type of request (e.g. IndexRequest ). |
audit_request_privilege |
The required privilege of the request (e.g. indices:data/read/search ). |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
audit_trace_indices |
The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true. |
audit_trace_resolved_indices |
The resolved index name(s) affected by the request. Only logged if resolve_indices is true. |
audit_trace_doc_types |
The document types affected by the request. Only logged if resolve_indices is true. |
Transport SSL_EXCEPTION attributes
Name | Description |
---|---|
audit_request_exception_stacktrace |
The stack trace of the SSL exception. |
Transport BAD_HEADERS attributes
Name | Description |
---|---|
audit_trace_task_id |
The ID of the request. |
audit_trace_task_parent_id |
The parent ID of this request, if any. |
audit_transport_headers |
The headers of the request, if any. |
audit_request_effective_user |
The username that failed to authenticate. |
audit_request_initiating_user |
The user that initiated the request. Only logged if it differs from the effective user. |
audit_transport_request_type |
The type of request (e.g. IndexRequest ). |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
audit_trace_indices |
The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true. |
audit_trace_resolved_indices |
The resolved index name(s) affected by the request. Only logged if resolve_indices is true. |
audit_trace_doc_types |
The document types affected by the request. Only logged if resolve_indices is true. |
Transport opensearch_SECURITY_INDEX_ATTEMPT attributes
Name | Description |
---|---|
audit_trace_task_id |
The ID of the request. |
audit_transport_headers |
The headers of the request, if any. |
audit_request_effective_user |
The username that failed to authenticate. |
audit_request_initiating_user |
The user that initiated the request. Only logged if it differs from the effective user. |
audit_transport_request_type |
The type of request (e.g. IndexRequest ). |
audit_request_body |
The HTTP request body, if any (and if request body logging is enabled). |
audit_trace_indices |
The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true. |
audit_trace_resolved_indices |
The resolved index name(s) affected by the request. Only logged if resolve_indices is true. |
audit_trace_doc_types |
The document types affected by the request. Only logged if resolve_indices is true. |