Audit Log: Index request_body, and store as text
#29,739 opened on Feb 10, 2017
Repository metrics
- Stars
- (76,700 stars)
- PR merge metrics
- (Avg merge 2d) (1,000 merged PRs in 30d)
Description
Original comment by @cwurm:
Currently, if a user enables logging the request_body it is stored as a keyword, and not indexed. I believe it should be a text and indexed, so it can be searched.
I hit on this when trying to find the request Kibana had made to fill a dashboard with data, and found what I had assumed would be simple unexpectedly hard. There's many requests logged even on a simple setup (10 requests per second with plain Kibana is normal) just looking through the most recent ones often doesn't work well. Search would help.
Also, if I want to look at all instances of this dashboard being run I'd need to filter on request_body.
I think this would be in line with the expected use of turning on full request logging: Being able to quickly find specific queries is a vital part of that, e.g. when trying to determine how often a specific query was run, and by whom.