Link Search Menu Expand Document Documentation Menu
Documentation

You're viewing version 3.8 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

Audit log field reference

This page contains descriptions for all audit log fields.

Common attributes

The following attributes are logged for all event categories, independent of the layer.

Name Description
audit_format_version The audit log message format version.
audit_category The audit log category. Values include FAILED_LOGIN, MISSING_PRIVILEGES, BAD_HEADERS, SSL_EXCEPTION, OPENSEARCH_SECURITY_INDEX_ATTEMPT, AUTHENTICATED, GRANTED_PRIVILEGES, CLUSTER_SETTINGS_CHANGED, and INDEX_SETTINGS_CHANGED.
audit_node_id The ID of the node where the event was generated.
audit_node_name The name of the node where the event was generated.
audit_node_host_address The host address of the node where the event was generated.
audit_node_host_name The hostname of the node where the event was generated.
audit_request_layer The layer on which the event has been generated, either TRANSPORT or REST.
audit_request_origin The layer from which the event originated, either TRANSPORT or REST.
audit_request_effective_user_is_admin True if the request was made with a TLS admin certificate, otherwise false.

REST FAILED_LOGIN attributes

The following attributes are logged for the REST layer failed login events.

Name Description
audit_request_effective_user The username that failed to authenticate.
audit_rest_request_path The REST endpoint URI.
audit_rest_request_params The HTTP request parameters, if any.
audit_rest_request_headers The HTTP headers, if any.
audit_request_initiating_user The user that initiated the request. Only logged if it differs from the effective user.
audit_request_body The HTTP request body, if any (and if request body logging is enabled).
audit_rest_request_method The HTTP request method.

REST AUTHENTICATED attributes

The following attributes are logged for the REST layer successful authentication events.

Name Description
audit_request_effective_user The username that failed to authenticate.
audit_request_initiating_user The user that initiated the request. Only logged if it differs from the effective user.
audit_rest_request_path The REST endpoint URI.
audit_rest_request_params The HTTP request parameters, if any.
audit_rest_request_headers The HTTP headers, if any.
audit_request_body The HTTP request body, if any (and if request body logging is enabled).
audit_rest_request_method The HTTP request method.

REST SSL_EXCEPTION attributes

The following attributes are logged for the REST layer SSL exception events.

Name Description
audit_request_exception_stacktrace The stack trace of the SSL exception.

REST BAD_HEADERS attributes

The following attributes are logged for the REST layer bad headers events.

Name Description
audit_rest_request_path The REST endpoint URI.
audit_rest_request_params The HTTP request parameters, if any.
audit_rest_request_headers The HTTP headers, if any.
audit_request_body The HTTP request body, if any (and if request body logging is enabled).

Transport FAILED_LOGIN attributes

The following attributes are logged for the transport layer failed login events.

Name Description
audit_trace_task_id The ID of the request.
audit_transport_headers The headers of the request, if any.
audit_request_effective_user The username that failed to authenticate.
audit_request_initiating_user The user that initiated the request. Only logged if it differs from the effective user.
audit_transport_request_type The request type (for example, IndexRequest).
audit_request_body The HTTP request body, if any (and if request body logging is enabled).
audit_trace_indices The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true.
audit_trace_resolved_indices The resolved index name(s) affected by the request. Only logged if resolve_indices is true.
audit_trace_doc_types The document types affected by the request. Only logged if resolve_indices is true.

Transport AUTHENTICATED attributes

The following attributes are logged for the transport layer successful authentication events.

Name Description
audit_trace_task_id The ID of the request.
audit_transport_headers The headers of the request, if any.
audit_request_effective_user The username that failed to authenticate.
audit_request_initiating_user The user that initiated the request. Only logged if it differs from the effective user.
audit_transport_request_type The request type (for example, IndexRequest).
audit_request_body The HTTP request body, if any (and if request body logging is enabled).
audit_trace_indices The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true.
audit_trace_resolved_indices The resolved index name(s) affected by the request. Only logged if resolve_indices is true.
audit_trace_doc_types The document types affected by the request. Only logged if resolve_indices is true.

Transport MISSING_PRIVILEGES attributes

The following attributes are logged for the transport layer missing privileges events.

Name Description
audit_trace_task_id The ID of the request.
audit_trace_task_parent_id The parent ID of this request, if any.
audit_transport_headers The headers of the request, if any.
audit_request_effective_user The username that failed to authenticate.
audit_request_initiating_user The user that initiated the request. Only logged if it differs from the effective user.
audit_transport_request_type The request type (for example, IndexRequest).
audit_request_privilege The required privilege of the request (for example, indices:data/read/search).
audit_request_body The HTTP request body, if any (and if request body logging is enabled).
audit_trace_indices The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true.
audit_trace_resolved_indices The resolved index name(s) affected by the request. Only logged if resolve_indices is true.
audit_trace_doc_types The document types affected by the request. Only logged if resolve_indices is true.

Transport GRANTED_PRIVILEGES attributes

The following attributes are logged for the transport layer granted privileges events.

Name Description
audit_trace_task_id The ID of the request.
audit_trace_task_parent_id The parent ID of this request, if any.
audit_transport_headers The headers of the request, if any.
audit_request_effective_user The username that failed to authenticate.
audit_request_initiating_user The user that initiated the request. Only logged if it differs from the effective user.
audit_transport_request_type The request type (for example, IndexRequest).
audit_request_privilege The required privilege of the request (for example, indices:data/read/search).
audit_request_body The HTTP request body, if any (and if request body logging is enabled).
audit_trace_indices The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true.
audit_trace_resolved_indices The resolved index name(s) affected by the request. Only logged if resolve_indices is true.
audit_trace_doc_types The document types affected by the request. Only logged if resolve_indices is true.

Transport SSL_EXCEPTION attributes

The following attributes are logged for the transport layer SSL exception events.

Name Description
audit_request_exception_stacktrace The stack trace of the SSL exception.

Transport BAD_HEADERS attributes

The following attributes are logged for the transport layer bad headers events.

Name Description
audit_trace_task_id The ID of the request.
audit_trace_task_parent_id The parent ID of this request, if any.
audit_transport_headers The headers of the request, if any.
audit_request_effective_user The username that failed to authenticate.
audit_request_initiating_user The user that initiated the request. Only logged if it differs from the effective user.
audit_transport_request_type The request type (for example, IndexRequest).
audit_request_body The HTTP request body, if any (and if request body logging is enabled).
audit_trace_indices The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true.
audit_trace_resolved_indices The resolved index name(s) affected by the request. Only logged if resolve_indices is true.
audit_trace_doc_types The document types affected by the request. Only logged if resolve_indices is true.

Transport opensearch_SECURITY_INDEX_ATTEMPT attributes

The following attributes are logged when a request attempts to access the OpenSearch security index.

Name Description
audit_trace_task_id The ID of the request.
audit_transport_headers The headers of the request, if any.
audit_request_effective_user The username that failed to authenticate.
audit_request_initiating_user The user that initiated the request. Only logged if it differs from the effective user.
audit_transport_request_type The request type (for example, IndexRequest).
audit_request_body The HTTP request body, if any (and if request body logging is enabled).
audit_trace_indices The index name(s) included in the request. Can contain wildcards, date patterns, and aliases. Only logged if resolve_indices is true.
audit_trace_resolved_indices The resolved index name(s) affected by the request. Only logged if resolve_indices is true.
audit_trace_doc_types The document types affected by the request. Only logged if resolve_indices is true.

Transport CLUSTER_SETTINGS_CHANGED attributes

The following attributes are logged when cluster settings are changed.

Name Description
audit_request_effective_user The user who made the setting change.
audit_transport_request_type The request type (for example, ClusterUpdateSettingsRequest).
audit_transport_action The transport action (for example, cluster:admin/settings/update).
audit_settings_changes An array of setting change objects, each containing setting, old_value, new_value, operation, and scope. Sensitive settings are automatically redacted.

Each object in audit_settings_changes contains the following fields.

Name Description
setting The full setting name (for example, cluster.max_shards_per_node).
old_value The previous value of the setting, or null if not previously set.
new_value The new value of the setting, or null if the setting was removed.
operation Either set (value was assigned) or removed (value was reset to the default).
scope Either persistent (survives restarts) or transient (lost on restart).

Transport INDEX_SETTINGS_CHANGED attributes

The following attributes are logged when index settings are changed.

Name Description
audit_request_effective_user The user who made the setting change.
audit_transport_request_type The request type (for example, UpdateSettingsRequest).
audit_transport_action The transport action (for example, indices:admin/settings/update).
audit_trace_indices The index name(s) included in the request. Can contain wildcards and aliases.
audit_trace_resolved_indices The resolved concrete index name(s) affected by the request.
audit_settings_changes An array of setting change objects, each containing setting, old_value, new_value, operation, and scope. Sensitive settings are automatically redacted.

Each object in audit_settings_changes contains the following fields.

Name Description
setting The full setting name (for example, index.number_of_replicas).
old_value The previous value of the setting, or null if not previously set.
new_value The new value of the setting, or null if the setting was removed.
operation Either set (value was assigned) or removed (value was reset to the default).
scope Always index for index setting changes.
350 characters left

Have a question? .

Want to contribute? or .