Skip to content

Commit 1ca9d19

Browse files
Resurrect the previous format alongside the new one
1 parent bb5928f commit 1ca9d19

4 files changed

Lines changed: 290 additions & 56 deletions

File tree

x-pack/plugin/core/src/main/config/log4j2.properties

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,40 @@
1+
appender.deprecated_audit_rolling.type = RollingFile
2+
appender.deprecated_audit_rolling.name = deprecated_audit_rolling
3+
appender.deprecated_audit_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_access.log
4+
appender.deprecated_audit_rolling.layout.type = PatternLayout
5+
appender.deprecated_audit_rolling.layout.pattern = \
6+
[%d{ISO8601}]\
7+
%varsNotEmpty{ [%map{host.ip}]}\
8+
%varsNotEmpty{ [%map{host.name}]}\
9+
%varsNotEmpty{ [%map{node.name}]}\
10+
\ [%map{event.type}]\
11+
\ [%map{event.action}]\
12+
\ \ \
13+
%varsNotEmpty{realm=[%map{realm}], }\
14+
origin_type=[%map{origin.type}]\
15+
%varsNotEmpty{, origin_address=[%map{origin.address}]}\
16+
%varsNotEmpty{, principal=[%map{user.name}]}\
17+
%varsNotEmpty{, realm=[%map{user.realm}]}\
18+
%varsNotEmpty{, run_by_principal=[%map{user.run_by.name}]}\
19+
%varsNotEmpty{, run_as_principal=[%map{user.run_as.name}]}\
20+
%varsNotEmpty{, run_by_realm=[%map{user.run_by.realm}]}\
21+
%varsNotEmpty{, run_as_realm=[%map{user.run_as.realm}]}\
22+
%varsNotEmpty{, roles=[%map{deprecated.user.roles}]}\
23+
%varsNotEmpty{, action=[%map{action}]}\
24+
%varsNotEmpty{, indices=[%map{deprecated.indices}]}\
25+
%varsNotEmpty{, request=[%map{request.name}]}\
26+
%varsNotEmpty{, transport_profile=[%map{transport.profile}]}\
27+
%varsNotEmpty{, rule=[%map{rule}]}\
28+
%varsNotEmpty{, uri=[%map{deprecated.uri}]}\
29+
%varsNotEmpty{, opaque_id=[%map{opaque_id}]}\
30+
%varsNotEmpty{, request_body=[%map{request.body}]}\
31+
%n
32+
appender.deprecated_audit_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_access-%d{yyyy-MM-dd}.log
33+
appender.deprecated_audit_rolling.policies.type = Policies
34+
appender.deprecated_audit_rolling.policies.time.type = TimeBasedTriggeringPolicy
35+
appender.deprecated_audit_rolling.policies.time.interval = 1
36+
appender.deprecated_audit_rolling.policies.time.modulate = true
37+
138
appender.audit_rolling.type = RollingFile
239
appender.audit_rolling.name = audit_rolling
340
appender.audit_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_audit.log
@@ -67,6 +104,7 @@ appender.audit_rolling.policies.time.modulate = true
67104
logger.xpack_security_audit_logfile.name = org.elasticsearch.xpack.security.audit.logfile.LoggingAuditTrail
68105
logger.xpack_security_audit_logfile.level = info
69106
logger.xpack_security_audit_logfile.appenderRef.audit_rolling.ref = audit_rolling
107+
logger.xpack_security_audit_logfile.appenderRef.deprecated_audit_rolling.ref = deprecated_audit_rolling
70108
logger.xpack_security_audit_logfile.additivity = false
71109

72110
logger.xmlsig.name = org.apache.xml.security.signature.XMLSignature

x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/audit/logfile/CapturingLogger.java

Lines changed: 62 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@
3030
*/
3131
public class CapturingLogger {
3232

33+
private static final String IMPLICIT_APPENDER_NAME = "__implicit";
34+
3335
/**
3436
* Constructs a new {@link CapturingLogger} named as the fully qualified name of
3537
* the invoking method. One name can be assigned to a single logger globally, so
@@ -52,42 +54,88 @@ public static Logger newCapturingLogger(final Level level, @Nullable StringLayou
5254
final String name = caller.getClassName() + "." + caller.getMethodName() + "." + level.toString();
5355
final Logger logger = ESLoggerFactory.getLogger(name);
5456
Loggers.setLevel(logger, level);
55-
final MockAppender appender = new MockAppender(name, layout);
57+
attachNewMockAppender(logger, IMPLICIT_APPENDER_NAME, layout);
58+
return logger;
59+
}
60+
61+
public static void attachNewMockAppender(final Logger logger, final String appenderName, @Nullable StringLayout layout)
62+
throws IllegalAccessException {
63+
final MockAppender appender = new MockAppender(buildAppenderName(logger.getName(), appenderName), layout);
5664
appender.start();
5765
Loggers.addAppender(logger, appender);
58-
return logger;
5966
}
6067

61-
private static MockAppender getMockAppender(final String name) {
68+
private static String buildAppenderName(final String loggerName, final String appenderName) {
69+
// appender name also has to be unique globally (logging context globally)
70+
return loggerName + "." + appenderName;
71+
}
72+
73+
private static MockAppender getMockAppender(final String loggerName, final String appenderName) {
6274
final LoggerContext ctx = (LoggerContext) LogManager.getContext(false);
6375
final Configuration config = ctx.getConfiguration();
64-
final LoggerConfig loggerConfig = config.getLoggerConfig(name);
65-
return (MockAppender) loggerConfig.getAppenders().get(name);
76+
final LoggerConfig loggerConfig = config.getLoggerConfig(loggerName);
77+
final String mockAppenderName = buildAppenderName(loggerName, appenderName);
78+
return (MockAppender) loggerConfig.getAppenders().get(mockAppenderName);
6679
}
6780

6881
/**
69-
* Checks if the logger's appender has captured any events.
82+
* Checks if the logger's appender(s) has captured any events.
7083
*
71-
* @param name
84+
* @param loggerName
7285
* The unique global name of the logger.
86+
* @param appenderNames
87+
* Names of other appenders nested under this same logger.
7388
* @return {@code true} if no event has been captured, {@code false} otherwise.
7489
*/
75-
public static boolean isEmpty(final String name) {
76-
final MockAppender appender = getMockAppender(name);
77-
return appender.isEmpty();
90+
public static boolean isEmpty(final String loggerName, final String... appenderNames) {
91+
// check if implicit appender is empty
92+
final MockAppender implicitAppender = getMockAppender(loggerName, IMPLICIT_APPENDER_NAME);
93+
assert implicitAppender != null;
94+
if (false == implicitAppender.isEmpty()) {
95+
return false;
96+
}
97+
if (null == appenderNames) {
98+
return true;
99+
}
100+
// check if any named appenders are empty
101+
for (String appenderName : appenderNames) {
102+
final MockAppender namedAppender = getMockAppender(loggerName, appenderName);
103+
if (namedAppender != null && false == namedAppender.isEmpty()) {
104+
return false;
105+
}
106+
}
107+
return true;
108+
}
109+
110+
/**
111+
* Gets the captured events for a logger by its name. Events are those of the
112+
* implicit appender of the logger.
113+
*
114+
* @param loggerName
115+
* The unique global name of the logger.
116+
* @param level
117+
* The priority level of the captured events to be returned.
118+
* @return A list of captured events formated to {@code String}.
119+
*/
120+
public static List<String> output(final String loggerName, final Level level) {
121+
return output(loggerName, IMPLICIT_APPENDER_NAME, level);
78122
}
79123

80124
/**
81-
* Gets the captured events for a logger by its name.
125+
* Gets the captured events for a logger and an appender by their respective
126+
* names. There is a one to many relationship between loggers and appenders.
82127
*
83-
* @param name
128+
* @param loggerName
84129
* The unique global name of the logger.
130+
* @param appenderName
131+
* The name of an appender associated with the {@code loggerName}
132+
* logger.
85133
* @param level
86134
* The priority level of the captured events to be returned.
87135
* @return A list of captured events formated to {@code String}.
88136
*/
89-
public static List<String> output(final String name, final Level level) {
90-
final MockAppender appender = getMockAppender(name);
137+
public static List<String> output(final String loggerName, final String appenderName, final Level level) {
138+
final MockAppender appender = getMockAppender(loggerName, appenderName);
91139
return appender.output(level);
92140
}
93141

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -611,6 +611,8 @@ LogEntryBuilder withRestUri(RestRequest request) {
611611
if (queryStringIndex > -1) {
612612
logEntry.with(URL_QUERY_FIELD_NAME, request.uri().substring(queryStringIndex + 1, queryStringLength));
613613
}
614+
// deprecated uri format
615+
logEntry.with("deprecated.uri", request.uri());
614616
return this;
615617
}
616618

@@ -626,10 +628,16 @@ LogEntryBuilder withRunAsSubject(Authentication authentication) {
626628

627629
LogEntryBuilder withRestOrigin(RestRequest request) {
628630
assert LOCAL_ORIGIN_FIELD_VALUE.equals(logEntry.get(ORIGIN_TYPE_FIELD_NAME)); // this is the default
629-
final InetSocketAddress socketAddress = request.getHttpChannel().getRemoteAddress();
631+
final String formattedAddress;
632+
final SocketAddress socketAddress = request.getRemoteAddress();
633+
if (socketAddress instanceof InetSocketAddress) {
634+
formattedAddress = NetworkAddress.format(((InetSocketAddress) socketAddress));
635+
} else {
636+
formattedAddress = socketAddress.toString();
637+
}
630638
if (socketAddress != null) {
631639
logEntry.with(ORIGIN_TYPE_FIELD_NAME, REST_ORIGIN_FIELD_VALUE)
632-
.with(ORIGIN_ADDRESS_FIELD_NAME, NetworkAddress.format(socketAddress));
640+
.with(ORIGIN_ADDRESS_FIELD_NAME, formattedAddress);
633641
}
634642
// fall through to local_node default
635643
return this;
@@ -700,6 +708,8 @@ LogEntryBuilder with(String key, String value) {
700708
LogEntryBuilder with(String key, String[] values) {
701709
if (values != null) {
702710
logEntry.with(key, toQuotedJsonArray(values));
711+
// deprecated format required for bwc
712+
logEntry.with("deprecated." + key, Strings.arrayToCommaDelimitedString(values));
703713
}
704714
return this;
705715
}

0 commit comments

Comments
 (0)