{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/elasticsearch/pulls/comments/227504867","pull_request_review_id":167562369,"id":227504867,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIyNzUwNDg2Nw==","diff_hunk":"@@ -3,13 +3,39 @@\n === Logfile audit output\n \n The `logfile` audit output is the default output for auditing. It writes data to\n-the `<clustername>_access.log` file in the logs directory.\n+the `<clustername>_audit.log` file in the logs directory. To maintain\n+compatibility with releases prior to 6.5.0, another file `<clustername>_access.log`\n+is also generated next to it. They differ in the output format but the contents\n+are similar. For systems that are not ingesting the audit file for search or\n+analytics it is strongly recommended to only keep the newer format.\n+Turning off the deprecated output format can be achieved by disabling the logger\n+in the `log4j2.properties` file in `ES_PATH_CONF` (hint: there is a config comment\n+about it).\n \n [float]\n [[audit-log-entry-format]]\n === Log entry format\n \n-The format of a log entry is:\n+This is describing the format for log entries as they are appended to the","path":"x-pack/docs/en/security/auditing/output-logfile.asciidoc","position":19,"original_position":19,"commit_id":"a8d8c71ddac4a5a575e4914ba60a1099fe713796","original_commit_id":"a8d8c71ddac4a5a575e4914ba60a1099fe713796","user":{"login":"lcawl","id":26471269,"node_id":"MDQ6VXNlcjI2NDcxMjY5","avatar_url":"https://avatars0.githubusercontent.com/u/26471269?v=4","gravatar_id":"","url":"https://api.github.com/users/lcawl","html_url":"https://github.com/lcawl","followers_url":"https://api.github.com/users/lcawl/followers","following_url":"https://api.github.com/users/lcawl/following{/other_user}","gists_url":"https://api.github.com/users/lcawl/gists{/gist_id}","starred_url":"https://api.github.com/users/lcawl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lcawl/subscriptions","organizations_url":"https://api.github.com/users/lcawl/orgs","repos_url":"https://api.github.com/users/lcawl/repos","events_url":"https://api.github.com/users/lcawl/events{/privacy}","received_events_url":"https://api.github.com/users/lcawl/received_events","type":"User","site_admin":false},"body":"I'd change this introductory sentence as follows:\r\n\r\n\"The log entries in the `<clustername>_audit.log` file have the following format:\"","created_at":"2018-10-23T18:07:57Z","updated_at":"2018-10-23T18:07:57Z","html_url":"https://github.com/elastic/elasticsearch/pull/34584#discussion_r227504867","pull_request_url":"https://api.github.com/repos/elastic/elasticsearch/pulls/34584","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/comments/227504867"},"html":{"href":"https://github.com/elastic/elasticsearch/pull/34584#discussion_r227504867"},"pull_request":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/34584"}}},"pull_request":{"url":"https://api.github.com/repos/elastic/elasticsearch/pulls/34584","id":223919097,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIzOTE5MDk3","html_url":"https://github.com/elastic/elasticsearch/pull/34584","diff_url":"https://github.com/elastic/elasticsearch/pull/34584.diff","patch_url":"https://github.com/elastic/elasticsearch/pull/34584.patch","issue_url":"https://api.github.com/repos/elastic/elasticsearch/issues/34584","number":34584,"state":"open","locked":false,"title":"Docs for the audit logfile structured format","user":{"login":"albertzaharovits","id":4568420,"node_id":"MDQ6VXNlcjQ1Njg0MjA=","avatar_url":"https://avatars2.githubusercontent.com/u/4568420?v=4","gravatar_id":"","url":"https://api.github.com/users/albertzaharovits","html_url":"https://github.com/albertzaharovits","followers_url":"https://api.github.com/users/albertzaharovits/followers","following_url":"https://api.github.com/users/albertzaharovits/following{/other_user}","gists_url":"https://api.github.com/users/albertzaharovits/gists{/gist_id}","starred_url":"https://api.github.com/users/albertzaharovits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/albertzaharovits/subscriptions","organizations_url":"https://api.github.com/users/albertzaharovits/orgs","repos_url":"https://api.github.com/users/albertzaharovits/repos","events_url":"https://api.github.com/users/albertzaharovits/events{/privacy}","received_events_url":"https://api.github.com/users/albertzaharovits/received_events","type":"User","site_admin":false},"body":"This is the docs part of the following work on structured logfile auditing:\r\nhttps://github.com/elastic/elasticsearch/pull/31931\r\nhttps://github.com/elastic/elasticsearch/pull/34475\r\n\r\nIt documents the format and file name changes.\r\n\r\nThis PR is geared towards the 6.x branch.\r\nIt will be followed by another one PR that will completely forget\r\nthe deprecated format (and will describe this as a breaking change,\r\nas has been suggested here https://github.com/elastic/elasticsearch/pull/34475#pullrequestreview-165208224)","created_at":"2018-10-18T11:23:35Z","updated_at":"2018-10-23T18:07:57Z","closed_at":null,"merged_at":null,"merge_commit_sha":"733a18d4ed7ba488b29facf61073a1d6aca63591","assignee":{"login":"albertzaharovits","id":4568420,"node_id":"MDQ6VXNlcjQ1Njg0MjA=","avatar_url":"https://avatars2.githubusercontent.com/u/4568420?v=4","gravatar_id":"","url":"https://api.github.com/users/albertzaharovits","html_url":"https://github.com/albertzaharovits","followers_url":"https://api.github.com/users/albertzaharovits/followers","following_url":"https://api.github.com/users/albertzaharovits/following{/other_user}","gists_url":"https://api.github.com/users/albertzaharovits/gists{/gist_id}","starred_url":"https://api.github.com/users/albertzaharovits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/albertzaharovits/subscriptions","organizations_url":"https://api.github.com/users/albertzaharovits/orgs","repos_url":"https://api.github.com/users/albertzaharovits/repos","events_url":"https://api.github.com/users/albertzaharovits/events{/privacy}","received_events_url":"https://api.github.com/users/albertzaharovits/received_events","type":"User","site_admin":false},"assignees":[{"login":"albertzaharovits","id":4568420,"node_id":"MDQ6VXNlcjQ1Njg0MjA=","avatar_url":"https://avatars2.githubusercontent.com/u/4568420?v=4","gravatar_id":"","url":"https://api.github.com/users/albertzaharovits","html_url":"https://github.com/albertzaharovits","followers_url":"https://api.github.com/users/albertzaharovits/followers","following_url":"https://api.github.com/users/albertzaharovits/following{/other_user}","gists_url":"https://api.github.com/users/albertzaharovits/gists{/gist_id}","starred_url":"https://api.github.com/users/albertzaharovits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/albertzaharovits/subscriptions","organizations_url":"https://api.github.com/users/albertzaharovits/orgs","repos_url":"https://api.github.com/users/albertzaharovits/repos","events_url":"https://api.github.com/users/albertzaharovits/events{/privacy}","received_events_url":"https://api.github.com/users/albertzaharovits/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":912837734,"node_id":"MDU6TGFiZWw5MTI4Mzc3MzQ=","url":"https://api.github.com/repos/elastic/elasticsearch/labels/:Security/Audit","name":":Security/Audit","color":"0e8a16","default":false},{"id":23715,"node_id":"MDU6TGFiZWwyMzcxNQ==","url":"https://api.github.com/repos/elastic/elasticsearch/labels/%3Edocs","name":">docs","color":"db755e","default":false},{"id":962378555,"node_id":"MDU6TGFiZWw5NjIzNzg1NTU=","url":"https://api.github.com/repos/elastic/elasticsearch/labels/v6.5.0","name":"v6.5.0","color":"Dddddd","default":false},{"id":484855464,"node_id":"MDU6TGFiZWw0ODQ4NTU0NjQ=","url":"https://api.github.com/repos/elastic/elasticsearch/labels/v7.0.0","name":"v7.0.0","color":"dddddd","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/elastic/elasticsearch/pulls/34584/commits","review_comments_url":"https://api.github.com/repos/elastic/elasticsearch/pulls/34584/comments","review_comment_url":"https://api.github.com/repos/elastic/elasticsearch/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/issues/34584/comments","statuses_url":"https://api.github.com/repos/elastic/elasticsearch/statuses/a8d8c71ddac4a5a575e4914ba60a1099fe713796","head":{"label":"albertzaharovits:docs-structured-audit-only","ref":"docs-structured-audit-only","sha":"a8d8c71ddac4a5a575e4914ba60a1099fe713796","user":{"login":"albertzaharovits","id":4568420,"node_id":"MDQ6VXNlcjQ1Njg0MjA=","avatar_url":"https://avatars2.githubusercontent.com/u/4568420?v=4","gravatar_id":"","url":"https://api.github.com/users/albertzaharovits","html_url":"https://github.com/albertzaharovits","followers_url":"https://api.github.com/users/albertzaharovits/followers","following_url":"https://api.github.com/users/albertzaharovits/following{/other_user}","gists_url":"https://api.github.com/users/albertzaharovits/gists{/gist_id}","starred_url":"https://api.github.com/users/albertzaharovits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/albertzaharovits/subscriptions","organizations_url":"https://api.github.com/users/albertzaharovits/orgs","repos_url":"https://api.github.com/users/albertzaharovits/repos","events_url":"https://api.github.com/users/albertzaharovits/events{/privacy}","received_events_url":"https://api.github.com/users/albertzaharovits/received_events","type":"User","site_admin":false},"repo":{"id":98969280,"node_id":"MDEwOlJlcG9zaXRvcnk5ODk2OTI4MA==","name":"elasticsearch","full_name":"albertzaharovits/elasticsearch","private":false,"owner":{"login":"albertzaharovits","id":4568420,"node_id":"MDQ6VXNlcjQ1Njg0MjA=","avatar_url":"https://avatars2.githubusercontent.com/u/4568420?v=4","gravatar_id":"","url":"https://api.github.com/users/albertzaharovits","html_url":"https://github.com/albertzaharovits","followers_url":"https://api.github.com/users/albertzaharovits/followers","following_url":"https://api.github.com/users/albertzaharovits/following{/other_user}","gists_url":"https://api.github.com/users/albertzaharovits/gists{/gist_id}","starred_url":"https://api.github.com/users/albertzaharovits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/albertzaharovits/subscriptions","organizations_url":"https://api.github.com/users/albertzaharovits/orgs","repos_url":"https://api.github.com/users/albertzaharovits/repos","events_url":"https://api.github.com/users/albertzaharovits/events{/privacy}","received_events_url":"https://api.github.com/users/albertzaharovits/received_events","type":"User","site_admin":false},"html_url":"https://github.com/albertzaharovits/elasticsearch","description":"Open Source, Distributed, RESTful Search Engine","fork":true,"url":"https://api.github.com/repos/albertzaharovits/elasticsearch","forks_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/forks","keys_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/keys{/key_id}","collaborators_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/teams","hooks_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/hooks","issue_events_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/issues/events{/number}","events_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/events","assignees_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/assignees{/user}","branches_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/branches{/branch}","tags_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/tags","blobs_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/git/refs{/sha}","trees_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/git/trees{/sha}","statuses_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/statuses/{sha}","languages_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/languages","stargazers_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/stargazers","contributors_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/contributors","subscribers_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/subscribers","subscription_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/subscription","commits_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/commits{/sha}","git_commits_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/git/commits{/sha}","comments_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/comments{/number}","issue_comment_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/issues/comments{/number}","contents_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/contents/{+path}","compare_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/compare/{base}...{head}","merges_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/merges","archive_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/downloads","issues_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/issues{/number}","pulls_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/pulls{/number}","milestones_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/milestones{/number}","notifications_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/labels{/name}","releases_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/releases{/id}","deployments_url":"https://api.github.com/repos/albertzaharovits/elasticsearch/deployments","created_at":"2017-08-01T06:49:47Z","updated_at":"2017-08-01T06:50:23Z","pushed_at":"2018-10-23T15:52:06Z","git_url":"git://github.com/albertzaharovits/elasticsearch.git","ssh_url":"git@github.com:albertzaharovits/elasticsearch.git","clone_url":"https://github.com/albertzaharovits/elasticsearch.git","svn_url":"https://github.com/albertzaharovits/elasticsearch","homepage":"https://www.elastic.co/products/elasticsearch","size":500036,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"elastic:master","ref":"master","sha":"60b8118d3a9036d2b828f967863049be08d018f8","user":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":507775,"node_id":"MDEwOlJlcG9zaXRvcnk1MDc3NzU=","name":"elasticsearch","full_name":"elastic/elasticsearch","private":false,"owner":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/elastic/elasticsearch","description":"Open Source, Distributed, RESTful Search Engine","fork":false,"url":"https://api.github.com/repos/elastic/elasticsearch","forks_url":"https://api.github.com/repos/elastic/elasticsearch/forks","keys_url":"https://api.github.com/repos/elastic/elasticsearch/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/elasticsearch/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/elasticsearch/teams","hooks_url":"https://api.github.com/repos/elastic/elasticsearch/hooks","issue_events_url":"https://api.github.com/repos/elastic/elasticsearch/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/elasticsearch/events","assignees_url":"https://api.github.com/repos/elastic/elasticsearch/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/elasticsearch/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/elasticsearch/tags","blobs_url":"https://api.github.com/repos/elastic/elasticsearch/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/elasticsearch/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/elasticsearch/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/elasticsearch/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/elasticsearch/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/elasticsearch/languages","stargazers_url":"https://api.github.com/repos/elastic/elasticsearch/stargazers","contributors_url":"https://api.github.com/repos/elastic/elasticsearch/contributors","subscribers_url":"https://api.github.com/repos/elastic/elasticsearch/subscribers","subscription_url":"https://api.github.com/repos/elastic/elasticsearch/subscription","commits_url":"https://api.github.com/repos/elastic/elasticsearch/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/elasticsearch/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/elasticsearch/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/elasticsearch/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/elasticsearch/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/elasticsearch/merges","archive_url":"https://api.github.com/repos/elastic/elasticsearch/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/elasticsearch/downloads","issues_url":"https://api.github.com/repos/elastic/elasticsearch/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/elasticsearch/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/elasticsearch/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/elasticsearch/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/elasticsearch/labels{/name}","releases_url":"https://api.github.com/repos/elastic/elasticsearch/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/elasticsearch/deployments","created_at":"2010-02-08T13:20:56Z","updated_at":"2018-10-23T17:38:56Z","pushed_at":"2018-10-23T18:07:33Z","git_url":"git://github.com/elastic/elasticsearch.git","ssh_url":"git@github.com:elastic/elasticsearch.git","clone_url":"https://github.com/elastic/elasticsearch.git","svn_url":"https://github.com/elastic/elasticsearch","homepage":"https://www.elastic.co/products/elasticsearch","size":521292,"stargazers_count":35480,"watchers_count":35480,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":11989,"mirror_url":null,"archived":false,"open_issues_count":1763,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":11989,"open_issues":1763,"watchers":35480,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/34584"},"html":{"href":"https://github.com/elastic/elasticsearch/pull/34584"},"issue":{"href":"https://api.github.com/repos/elastic/elasticsearch/issues/34584"},"comments":{"href":"https://api.github.com/repos/elastic/elasticsearch/issues/34584/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/34584/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/34584/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/elasticsearch/statuses/a8d8c71ddac4a5a575e4914ba60a1099fe713796"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"lcawl"}}