Skip to content

[Embeddables] Excessive index-pattern SO access when loading a dashboard  #90996

Closed
Closed
[Embeddables] Excessive index-pattern SO access when loading a dashboard #90996
Labels
Feature:DashboardDashboard related featuresFeature:Data ViewsData Views code and UI - index patterns before 8.0enhancementNew value added to drive a business resultimpact:needs-assessmentProduct and/or Engineering needs to evaluate the impact of the change.loe:smallSmall Level of Effortperformance
@Dosant

Description

@Dosant
Dosant
opened on Feb 10, 2021

Kibana Version: master

Description:
While working on search sessions we were looking into audit logs to see how often we fetch/update search-session SO.

In a meantime, we noticed that when loading a sample dashboard the same index pattern is being fetched from es 64 times!

{"@timestamp":"2021-02-10T16:28:40.977+01:00","message":"User has accessed dashboard [id=edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"dashboard","id":"edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"bdec69a5-fdbb-4fd6-834a-c584819d1567"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=e1d0f010-9ee7-11e7-8711-e7a007dcef99]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"e1d0f010-9ee7-11e7-8711-e7a007dcef99"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=935afa20-e0cd-11e7-9d07-1398ccfcefa3]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"935afa20-e0cd-11e7-9d07-1398ccfcefa3"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=4eb6e500-e1c7-11e7-b6d5-4dc382ef7f5b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"4eb6e500-e1c7-11e7-b6d5-4dc382ef7f5b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=69a34b00-9ee8-11e7-8711-e7a007dcef99]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"69a34b00-9ee8-11e7-8711-e7a007dcef99"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=42b997f0-0c26-11e8-b0ec-3bb475f6b6ff]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"42b997f0-0c26-11e8-b0ec-3bb475f6b6ff"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=7cbd2350-2223-11e8-b802-5bcf64c2cfb4]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"7cbd2350-2223-11e8-b802-5bcf64c2cfb4"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=314c6f60-2224-11e8-b802-5bcf64c2cfb4]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"314c6f60-2224-11e8-b802-5bcf64c2cfb4"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=24a3e970-4257-11e8-b3aa-73fdaf54bfc9]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"24a3e970-4257-11e8-b3aa-73fdaf54bfc9"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=14e2e710-4258-11e8-b3aa-73fdaf54bfc9]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"14e2e710-4258-11e8-b3aa-73fdaf54bfc9"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=47f2c680-a6e3-11e8-94b4-c30c0228351b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"47f2c680-a6e3-11e8-94b4-c30c0228351b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.243+01:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d907a5fd-c5ad-4484-8cc6-fe900e53ee3b"}}
{"@timestamp":"2021-02-10T16:28:41.276+01:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d907a5fd-c5ad-4484-8cc6-fe900e53ee3b"}}
{"@timestamp":"2021-02-10T16:28:41.482+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"a7f6f31a-b9bc-4768-a2d8-fbee96d1487e"}}
{"@timestamp":"2021-02-10T16:28:41.511+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3a4c0fbf-ca02-4a92-99dc-2a4e48fec6e2"}}
{"@timestamp":"2021-02-10T16:28:41.513+01:00","message":"User has accessed map [id=de71f4f0-1902-11e9-919b-ffe5949a18d2]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"map","id":"de71f4f0-1902-11e9-919b-ffe5949a18d2"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"755fc2e0-b692-4218-a585-8483df6bbf74"}}
{"@timestamp":"2021-02-10T16:28:41.513+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"755fc2e0-b692-4218-a585-8483df6bbf74"}}
{"@timestamp":"2021-02-10T16:28:41.562+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e333c73b-4151-4506-81b5-3d059b77fce3"}}
{"@timestamp":"2021-02-10T16:28:41.583+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d6f36c0e-a280-4a35-8a13-bda819880313"}}
{"@timestamp":"2021-02-10T16:28:42.028+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.044+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.162+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.186+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.391+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.468+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.470+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.486+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.493+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.494+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.526+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.609+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.612+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.621+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.627+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.629+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.633+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.686+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.690+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.704+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.707+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.714+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.717+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.749+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.794+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.803+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.809+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.814+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.820+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.867+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.876+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.880+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.886+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.887+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.893+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.893+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.895+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.906+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.962+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.973+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.975+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.994+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.996+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.998+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.042+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.043+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.066+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.067+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.070+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:43.071+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.072+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.074+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.084+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:43.104+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.107+01:00","message":"User is creating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_create","category":"database","type":"creation","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:43.108+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.123+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.127+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.129+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.131+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.699+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:45.061+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"41eecc02-a366-4d9c-98dd-063fc90a2530"}}

In this case, I have opened [Logs] Web Traffic
and my logging configuration:

xpack.security.audit:
  enabled: true
  appender:
    kind: console
    layout:
      kind: json
  ignore_filters:
    - actions: [http_request]

I am not sure what is causing such excessive fetching, especially as we recently significantly improved index-pattern fetching: #82153 #82603 . In the browser, there is seem like 5-10 fetches of the same index pattern from different visualizations, but I not even close to 64 that audit logs report.

This issue is very likely causing redundant load on kibana server and es with each dashboard load which we probably can reduce it.

I not sure if there is a similar situation in an older versions

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature:DashboardDashboard related featuresFeature:Data ViewsData Views code and UI - index patterns before 8.0enhancementNew value added to drive a business resultimpact:needs-assessmentProduct and/or Engineering needs to evaluate the impact of the change.loe:smallSmall Level of Effortperformance

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions