Skip to content

[Search Sessions] batch trackId calls#90956

Merged
Dosant merged 9 commits intoelastic:masterfrom
Dosant:dev/throttle-trackId
Feb 11, 2021
Merged

[Search Sessions] batch trackId calls#90956
Dosant merged 9 commits intoelastic:masterfrom
Dosant:dev/throttle-trackId

Conversation

@Dosant
Copy link
Copy Markdown
Contributor

@Dosant Dosant commented Feb 10, 2021 •
edited
Loading

Summary

Not sure if we need this, want to check if it helps with this noise

Opening [Logs] Web Traffic dashboard audit logs locally

Before

updating search-session ~16-20 times in total

{"@timestamp":"2021-02-10T16:32:55.921+01:00","message":"User has accessed dashboard [id=edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"dashboard","id":"edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"4409ee6f-b8bc-4375-b888-8110efddd41e"}}
{"@timestamp":"2021-02-10T16:32:56.139+01:00","message":"User has accessed visualization [id=e1d0f010-9ee7-11e7-8711-e7a007dcef99]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"e1d0f010-9ee7-11e7-8711-e7a007dcef99"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.139+01:00","message":"User has accessed visualization [id=935afa20-e0cd-11e7-9d07-1398ccfcefa3]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"935afa20-e0cd-11e7-9d07-1398ccfcefa3"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.139+01:00","message":"User has accessed visualization [id=4eb6e500-e1c7-11e7-b6d5-4dc382ef7f5b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"4eb6e500-e1c7-11e7-b6d5-4dc382ef7f5b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.139+01:00","message":"User has accessed visualization [id=69a34b00-9ee8-11e7-8711-e7a007dcef99]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"69a34b00-9ee8-11e7-8711-e7a007dcef99"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.139+01:00","message":"User has accessed visualization [id=42b997f0-0c26-11e8-b0ec-3bb475f6b6ff]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"42b997f0-0c26-11e8-b0ec-3bb475f6b6ff"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.140+01:00","message":"User has accessed visualization [id=7cbd2350-2223-11e8-b802-5bcf64c2cfb4]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"7cbd2350-2223-11e8-b802-5bcf64c2cfb4"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.140+01:00","message":"User has accessed visualization [id=314c6f60-2224-11e8-b802-5bcf64c2cfb4]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"314c6f60-2224-11e8-b802-5bcf64c2cfb4"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.140+01:00","message":"User has accessed visualization [id=24a3e970-4257-11e8-b3aa-73fdaf54bfc9]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"24a3e970-4257-11e8-b3aa-73fdaf54bfc9"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.140+01:00","message":"User has accessed visualization [id=14e2e710-4258-11e8-b3aa-73fdaf54bfc9]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"14e2e710-4258-11e8-b3aa-73fdaf54bfc9"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.140+01:00","message":"User has accessed visualization [id=47f2c680-a6e3-11e8-94b4-c30c0228351b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"47f2c680-a6e3-11e8-94b4-c30c0228351b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.140+01:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"24903f56-4884-48b2-9d08-4ac72fa7f999"}}
{"@timestamp":"2021-02-10T16:32:56.330+01:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d7e6a3b8-919b-4cbb-b940-2cf2371f6779"}}
{"@timestamp":"2021-02-10T16:32:56.361+01:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d7e6a3b8-919b-4cbb-b940-2cf2371f6779"}}
{"@timestamp":"2021-02-10T16:32:56.384+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"467dcc9a-5bdb-4130-ac2c-8d14e79ea0ff"}}
{"@timestamp":"2021-02-10T16:32:56.438+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"886a6a26-c621-4dbf-95d6-47730bc5882b"}}
{"@timestamp":"2021-02-10T16:32:56.457+01:00","message":"User has accessed map [id=de71f4f0-1902-11e9-919b-ffe5949a18d2]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"map","id":"de71f4f0-1902-11e9-919b-ffe5949a18d2"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"48e2053a-bc4a-46f1-b676-cab46f85aac6"}}
{"@timestamp":"2021-02-10T16:32:56.457+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"48e2053a-bc4a-46f1-b676-cab46f85aac6"}}
{"@timestamp":"2021-02-10T16:32:56.461+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7e3da3b1-271c-4ac8-b650-80f8f62b765b"}}
{"@timestamp":"2021-02-10T16:32:56.481+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"01913b82-7094-463a-9b27-ab1d38ba412b"}}
{"@timestamp":"2021-02-10T16:32:56.888+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:56.895+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"53b8c9c0-43c2-47cf-81df-a1db4151748e"}}
{"@timestamp":"2021-02-10T16:32:56.964+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"53b8c9c0-43c2-47cf-81df-a1db4151748e"}}
{"@timestamp":"2021-02-10T16:32:56.979+01:00","message":"User is creating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_create","category":"database","type":"creation","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"53b8c9c0-43c2-47cf-81df-a1db4151748e"}}
{"@timestamp":"2021-02-10T16:32:56.990+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"53b8c9c0-43c2-47cf-81df-a1db4151748e"}}
{"@timestamp":"2021-02-10T16:32:56.998+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"53b8c9c0-43c2-47cf-81df-a1db4151748e"}}
{"@timestamp":"2021-02-10T16:32:57.002+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"05299ddb-c7ef-4c4e-a88e-54cc7863664c"}}
{"@timestamp":"2021-02-10T16:32:57.009+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.063+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"53b8c9c0-43c2-47cf-81df-a1db4151748e"}}
{"@timestamp":"2021-02-10T16:32:57.086+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.202+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"05299ddb-c7ef-4c4e-a88e-54cc7863664c"}}
{"@timestamp":"2021-02-10T16:32:57.248+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"53b8c9c0-43c2-47cf-81df-a1db4151748e"}}
{"@timestamp":"2021-02-10T16:32:57.257+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"b4f6b4e2-fc30-4e37-9032-532d9ecc52e9"}}
{"@timestamp":"2021-02-10T16:32:57.269+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"b4f6b4e2-fc30-4e37-9032-532d9ecc52e9"}}
{"@timestamp":"2021-02-10T16:32:57.274+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"b4f6b4e2-fc30-4e37-9032-532d9ecc52e9"}}
{"@timestamp":"2021-02-10T16:32:57.275+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.276+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.277+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.279+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.279+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.280+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.280+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.281+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.283+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.285+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.285+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.294+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"b4f6b4e2-fc30-4e37-9032-532d9ecc52e9"}}
{"@timestamp":"2021-02-10T16:32:57.295+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.333+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.334+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.336+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.338+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.340+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.368+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.370+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.372+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.374+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.375+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"05299ddb-c7ef-4c4e-a88e-54cc7863664c"}}
{"@timestamp":"2021-02-10T16:32:57.376+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.378+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.390+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.470+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3ce613ac-cd5c-4275-81db-e44d6be9f2d3"}}
{"@timestamp":"2021-02-10T16:32:57.486+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"05299ddb-c7ef-4c4e-a88e-54cc7863664c"}}
{"@timestamp":"2021-02-10T16:32:57.515+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.518+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.518+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.519+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.520+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.520+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.521+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.522+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.522+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.523+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.532+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.535+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.571+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.593+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"05299ddb-c7ef-4c4e-a88e-54cc7863664c"}}
{"@timestamp":"2021-02-10T16:32:57.597+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.599+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.600+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.602+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.603+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.605+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.607+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.609+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.617+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.621+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.627+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e937459b-23ce-4839-9204-39f0edd41a0c"}}
{"@timestamp":"2021-02-10T16:32:57.690+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"0b975d75-a171-4830-b762-adc3dd7cb25e"}}
{"@timestamp":"2021-02-10T16:32:57.701+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"05299ddb-c7ef-4c4e-a88e-54cc7863664c"}}
{"@timestamp":"2021-02-10T16:32:57.775+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"605431bd-4d69-4004-a04d-1709d119edcd"}}
{"@timestamp":"2021-02-10T16:32:57.786+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"605431bd-4d69-4004-a04d-1709d119edcd"}}
{"@timestamp":"2021-02-10T16:32:57.828+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"605431bd-4d69-4004-a04d-1709d119edcd"}}
{"@timestamp":"2021-02-10T16:32:57.936+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"ec99390c-39b9-40d1-b27b-c8e1091d564e"}}
{"@timestamp":"2021-02-10T16:32:59.159+01:00","message":"User is updating search-session [id=510b78d0-ff0c-41e2-8a23-23093e8fc087]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":96438},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"510b78d0-ff0c-41e2-8a23-23093e8fc087"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"59f5498c-26f6-4519-b468-7a5002bd3a7c"}}

After
updating search-session ~3 times in total

{"@timestamp":"2021-02-10T16:28:40.977+01:00","message":"User has accessed dashboard [id=edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"dashboard","id":"edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"bdec69a5-fdbb-4fd6-834a-c584819d1567"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=e1d0f010-9ee7-11e7-8711-e7a007dcef99]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"e1d0f010-9ee7-11e7-8711-e7a007dcef99"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=935afa20-e0cd-11e7-9d07-1398ccfcefa3]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"935afa20-e0cd-11e7-9d07-1398ccfcefa3"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=4eb6e500-e1c7-11e7-b6d5-4dc382ef7f5b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"4eb6e500-e1c7-11e7-b6d5-4dc382ef7f5b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=69a34b00-9ee8-11e7-8711-e7a007dcef99]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"69a34b00-9ee8-11e7-8711-e7a007dcef99"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=42b997f0-0c26-11e8-b0ec-3bb475f6b6ff]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"42b997f0-0c26-11e8-b0ec-3bb475f6b6ff"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=7cbd2350-2223-11e8-b802-5bcf64c2cfb4]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"7cbd2350-2223-11e8-b802-5bcf64c2cfb4"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=314c6f60-2224-11e8-b802-5bcf64c2cfb4]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"314c6f60-2224-11e8-b802-5bcf64c2cfb4"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=24a3e970-4257-11e8-b3aa-73fdaf54bfc9]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"24a3e970-4257-11e8-b3aa-73fdaf54bfc9"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=14e2e710-4258-11e8-b3aa-73fdaf54bfc9]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"14e2e710-4258-11e8-b3aa-73fdaf54bfc9"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=47f2c680-a6e3-11e8-94b4-c30c0228351b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"47f2c680-a6e3-11e8-94b4-c30c0228351b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.243+01:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d907a5fd-c5ad-4484-8cc6-fe900e53ee3b"}}
{"@timestamp":"2021-02-10T16:28:41.276+01:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d907a5fd-c5ad-4484-8cc6-fe900e53ee3b"}}
{"@timestamp":"2021-02-10T16:28:41.482+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"a7f6f31a-b9bc-4768-a2d8-fbee96d1487e"}}
{"@timestamp":"2021-02-10T16:28:41.511+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3a4c0fbf-ca02-4a92-99dc-2a4e48fec6e2"}}
{"@timestamp":"2021-02-10T16:28:41.513+01:00","message":"User has accessed map [id=de71f4f0-1902-11e9-919b-ffe5949a18d2]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"map","id":"de71f4f0-1902-11e9-919b-ffe5949a18d2"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"755fc2e0-b692-4218-a585-8483df6bbf74"}}
{"@timestamp":"2021-02-10T16:28:41.513+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"755fc2e0-b692-4218-a585-8483df6bbf74"}}
{"@timestamp":"2021-02-10T16:28:41.562+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e333c73b-4151-4506-81b5-3d059b77fce3"}}
{"@timestamp":"2021-02-10T16:28:41.583+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d6f36c0e-a280-4a35-8a13-bda819880313"}}
{"@timestamp":"2021-02-10T16:28:42.028+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.044+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.162+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.186+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.391+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.468+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.470+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.486+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.493+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.494+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.526+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.609+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.612+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.621+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.627+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.629+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.633+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.686+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.690+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.704+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.707+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.714+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.717+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.749+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.794+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.803+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.809+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.814+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.820+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.867+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.876+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.880+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.886+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.887+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.893+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.893+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.895+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.906+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.962+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.973+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.975+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.994+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.996+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.998+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.042+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.043+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.066+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.067+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.070+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:43.071+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.072+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.074+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.084+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:43.104+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.107+01:00","message":"User is creating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_create","category":"database","type":"creation","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:43.108+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.123+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.127+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.129+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.131+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.699+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:45.061+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"41eecc02-a366-4d9c-98dd-063fc90a2530"}}

After the change

Checklist

Delete any items that are not applicable to this PR.

For maintainers

This was referenced Feb 10, 2021
Closed
Closed
Dosant
Dosant commented Feb 10, 2021
View reviewed changes
Comment thread x-pack/test/api_integration/apis/search/session.ts
const idMappings = Object.values(idMapping).map((value: any) => value.id);
expect(idMappings).to.contain(id1);
expect(idMappings).to.contain(id2);
await retry.waitForWithTimeout('searches persisted into session', 5000, async () => {
Copy link
Copy Markdown
Contributor Author

@Dosant Dosant Feb 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We anyway had a subtle race condition here before this pr, because we never awaited trackId inside session service. No time to track increase because of batching, so this test was failing more ofter

@Dosant Dosant added Feature:Search Querying infrastructure in Kibana release_note:skip Skip the PR/issue when compiling release notes Team:AppServices v7.12.0 v8.0.0 labels Feb 10, 2021
@Dosant Dosant marked this pull request as ready for review February 10, 2021 19:42
@Dosant Dosant requested a review from a team as a code owner February 10, 2021 19:42
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Feb 10, 2021

Pinging @elastic/kibana-app-services (Team:AppServices)

@Dosant Dosant requested review from lizozom and lukasolson February 10, 2021 19:42
@lizozom lizozom mentioned this pull request Feb 11, 2021
Merged
2 tasks
lizozom
lizozom approved these changes Feb 11, 2021
View reviewed changes
Copy link
Copy Markdown
Contributor

@lizozom lizozom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested and working fine.
I wonder if we should increase the debounce interval a little. Even on my local machine, a dashboard search session is still updated in a total of 3-4 calls to ES (which is still a huge improvement from 2-3 calls per search!)

Comment thread x-pack/plugins/data_enhanced/server/search/session/session_service.ts Outdated
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Feb 11, 2021

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@Dosant Dosant merged commit a42eab1 into elastic:master Feb 11, 2021
Dosant added a commit to Dosant/kibana that referenced this pull request Feb 11, 2021
@Dosant
[Search Sessions] batch trackId calls (elastic#90956)
c9b46f8
@Dosant Dosant mentioned this pull request Feb 11, 2021
Merged
Dosant added a commit that referenced this pull request Feb 12, 2021
@Dosant
[Search Sessions] batch trackId calls (#90956) (#91186)
a183cef
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lukasolson lukasolson Awaiting requested review from lukasolson

1 more reviewer

@lizozom lizozom lizozom approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

Feature:Search Querying infrastructure in Kibana release_note:skip Skip the PR/issue when compiling release notes v7.12.0 v8.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Dosant @elasticmachine @kibanamachine @lizozom