Emit trace.id into audit logs#82849
Conversation
|
Pinging @elastic/es-security (Team:Security) |
|
Pinging @elastic/es-core-infra (Team:Core/Infra) |
|
this can be considered a >bug rather than >enhancement as we clearly forgot about this |
|
Hi @pgomulka, I've created a changelog YAML for you. |
…csearch into add_trace_id_audit_trail
albertzaharovits
left a comment
There was a problem hiding this comment.
LGTM Thanks for the Security contrib!
Ideally we should add to the docs in x-pack/docs/en/security/auditing/event-types.asciidoc to describe the new field (also drop a line in log4j2.properties with a short description as well).
Also, reviewing this I noticed that the response, http tracer and search slowlog (and possibly other places as well), do not contain a trace.id. It might be worth a ES-wide review of where the trace.id should show up.
since elastic#74210 ES is emitting trace.id into its logs, but it did not emit it into audit logs. This commit adds trace.id into audit logging.
💔 Backport failed
You can use sqren/backport to manually backport by running |
since elastic#74210 ES is emitting trace.id into its logs, but it did not emit it into audit logs. This commit adds trace.id into audit logging.
* upstream/master: (762 commits) [DOCS] Add note to that log4j customization is outside the support scope (elastic#82668) Batch Index Settings Update Requests (elastic#82896) [DOCS] Delete pipeline containing stored script (elastic#83102) Try again to fix changelog areas after reorg (elastic#83100) Bind to non-localhost for transport in some cases (elastic#82973) [DOCS] Reuse multi-level `join` warning (elastic#82976) Remove unnecessary CopyOnWriteHashMap class (elastic#83040) Adjust changelog categories after reorg (elastic#83087) [DOCS] Fix typo in `action.destructive_requires_name` breaking change (elastic#83085) Stack Monitoring: Add Enterprise Search monitoring index templates (elastic#82743) [DOCS] Fix stored script example snippet (elastic#83056) [DOCS] Re-add network traffic para to `term` query (elastic#83047) [DOCS] Rename example stored script (elastic#83054) [ML][DOCS] Add Trained model APIs to the REST APIs index (elastic#82791) [ML] Update running process when global calendar changes (elastic#83044) [Transform] Fix condition on which the transform stops processing buckets (elastic#82852) [DOCS] Fixes field names in ML sum functions. (elastic#83048) [ML] fix NLP tokenization never_split handling around punctuation (elastic#82982) Construct dynamic updates directly via object builders (elastic#81449) Emit trace.id into audit logs (elastic#82849) ... # Conflicts: # client/rest-high-level/src/test/java/org/elasticsearch/client/IndicesClientIT.java # client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/ILMDocumentationIT.java # server/src/main/java/org/elasticsearch/action/admin/indices/rollover/Condition.java # server/src/test/java/org/elasticsearch/action/admin/indices/rollover/ConditionTests.java # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ilm/RolloverActionTests.java # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ilm/TimeseriesLifecycleTypeTests.java # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ilm/WaitForRolloverReadyStepTests.java
since #74210 ES is emitting trace.id into its logs, but it did not emit it into audit logs.
This commit adds trace.id into audit logging.