WARNING: Version 6.2 of Filebeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Apache2 fields Beat fields »
Elastic Docs ›Filebeat Reference [6.2] ›Exported fields

Auditd fields

edit

Auditd fields

edit

Module for parsing auditd logs.

auditd fields

edit

Fields from the auditd logs.

log fields

edit

Fields from the Linux audit log. Not all fields are documented here because they are dynamic and vary by audit event type.

auditd.log.record_type

edit

The audit event type.

auditd.log.old_auid

edit

For login events this is the old audit ID used for the user prior to this login.

auditd.log.new_auid

edit

For login events this is the new audit ID. The audit ID can be used to trace future events to the user even if their identity changes (like becoming root).

auditd.log.old_ses

edit

For login events this is the old session ID used for the user prior to this login.

auditd.log.new_ses

edit

For login events this is the new session ID. It can be used to tie a user to future events by session ID.

auditd.log.sequence

edit

type: long

The audit event sequence number.

auditd.log.acct

edit

The user account name associated with the event.

auditd.log.pid

edit

The ID of the process.

auditd.log.ppid

edit

The ID of the process.

auditd.log.items

edit

The number of items in an event.

auditd.log.item

edit

The item field indicates which item out of the total number of items. This number is zero-based; a value of 0 means it is the first item.

auditd.log.a0

edit

The first argument to the system call.

auditd.log.res

edit

The result of the system call (success or failure).

geoip fields

edit

Contains GeoIP information gathered based on the auditd.log.addr field. Only present if the GeoIP Elasticsearch plugin is available and used.

auditd.log.geoip.continent_name

edit

type: keyword

The name of the continent.

auditd.log.geoip.city_name

edit

type: keyword

The name of the city.

auditd.log.geoip.region_name

edit

type: keyword

The name of the region.

auditd.log.geoip.country_iso_code

edit

type: keyword

Country ISO code.

auditd.log.geoip.location

edit

type: geo_point

The longitude and latitude.

« Apache2 fields Beat fields »