IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Index audit output Forwarding audit logs to a remote cluster »
Elastic Docs ›Elasticsearch Guide [6.6] ›Secure a cluster ›Auditing security events

Auditing search queries

edit

Auditing search queries

edit

There is no audit event type specifically dedicated to search queries. Search queries are analyzed and then processed; the processing triggers authorization actions that are audited. However, the original raw query, as submitted by the client, is not accessible downstream when authorization auditing occurs.

Search queries are contained inside HTTP request bodies, however, and some audit events that are generated by the REST layer can be toggled to output the request body to the audit log.

To make certain audit events include the request body, edit the following settings in the elasticsearch.yml file:

  • For the logfile audit output:

    xpack.security.audit.logfile.events.emit_request_body: true

  • For the index output:

    xpack.security.audit.index.events.emit_request_body: true

No filtering is performed when auditing, so sensitive data might be audited in plain text when audit events include the request body. Also, the request body can contain malicious content that can break a parser consuming the audit logs.

There are only a handful of audit event types that are generated in the REST layer and can access the request body. Most of them are not included by default.

A good practical piece of advice is to add authentication_success to the event types that are audited. Add it to the list in the xpack.security.audit.logfile.events.include or xpack.security.audit.index.events.include settings. This type is not audited by default.

Typically, the include list contains other event types as well, such as access_granted or access_denied.

« Index audit output Forwarding audit logs to a remote cluster »