Parse more fields from elasticsearch audit log#10356
Parse more fields from elasticsearch audit log#10356ycombinator merged 10 commits intoelastic:masterfrom ycombinator:fb-es-audit-log-more-fields
Conversation
|
Pinging @elastic/stack-monitoring |
|
jenkins, test this |
There was a problem hiding this comment.
Breaking change or was never release?
There was a problem hiding this comment.
I think this qualifies as a breaking change. Previously we thought that the value of realm=[...] was the authenticated user's realm (es.audit.user.realm) but it turns out to be the realm that was used to test against before the user was authenticated or not (es.audit.realm).
The JSON audit logs contain both fields, but the plaintext audit logs only contain the latter one (es.audit.realm). Hence this change.
From a ES mapping perspective, we're introducing a new field here, es.audit.realm so in that sense it's not a breaking change.
This reverts commit ab7cf63.
webmat
left a comment
There was a problem hiding this comment.
LGTM overall, except for message.
Since this is a structured log, without another message field in it, it can be tricky to have a good message field as a result. The current value could at least be stripped out of the timestamp. The rest is important for context (if you think about looking at this log with the log viewer).
So ideally that's the one change I would request here. Although not the end of the world if you don't have time. Getting good message fields across the board will take time.
|
As discussed, never mind about |
Follow up to #10352 per #10352 (comment):
Accordingly, this PR adds sample lines to the structured and unstructured log file test fixtures for the
elasticsearch/auditfileset and teaches the fileset to parse any new fields encountered in these sample lines.