Logstash OpenSearch Output

Security
1

Hi,
I’m trying to send data to OpenSearch using LogStash OpenSearch Output Plugin.

On OpenSearch audit logs there are many entries like:

{
  "_index": "security-auditlog-2021.10.19",
  "_type": "_doc",
  "_id": "Rd6WmXwBI4rOM_mKvxUM",
  "_version": 1,
  "_score": null,
  "_source": {
    "audit_trace_task_parent_id": "Ms_aBTLURsy_eGdWNCvyuA:698723",
    "audit_cluster_name": "logs-corporativos",
    "audit_transport_headers": {
      "_opendistro_security_remote_address_header": "...",
      "_opendistro_security_initial_action_class_header": "GetIndexTemplatesRequest",
      "_opendistro_security_origin_header": "REST",
      "_opendistro_security_user_header": "...",
      "_opendistro_security_remotecn": "logs-corporativos"
    },
    "audit_node_name": "logs-corporativos-master-2",
    "audit_trace_task_id": "XXy6-_cET4CIHg8L6A6nGA:4038008",
    "audit_transport_request_type": "GetIndexTemplatesRequest",
    "audit_category": "INDEX_EVENT",
    "audit_request_origin": "REST",
    "audit_node_id": "XXy6-_cET4CIHg8L6A6nGA",
    "audit_request_layer": "TRANSPORT",
    "@timestamp": "2021-10-19T17:26:05.835+00:00",
    "audit_format_version": 4,
    "audit_request_remote_address": "10.42.241.142",
    "audit_request_privilege": "indices:admin/template/get",
    "audit_node_host_address": "10.42.111.116",
    "audit_request_effective_user": "logstash",
    "audit_node_host_name": "10.42.111.116"
  },
  "fields": {
    "@timestamp": [
      "2021-10-19T17:26:05.835Z"
    ]
  },
  "highlight": {
    "audit_request_effective_user": [
      "@opensearch-dashboards-highlighted-field@logstash@/opensearch-dashboards-highlighted-field@"
    ]
  },
  "sort": [
    1634664365835
  ]
}

What is the meaning of such event?
Is everything fine?
The logs are not being persisted by OpenSearch.

2

Moving this to the security category - this is more about the audit logs than logstash :slight_smile:

3

@louzadod
This is internal communications where GetIndexTemplatesRequest is being called, to obtain template during indexing stage and therefore looks to be ok.

Hope this helps

4

Thanks! Everything working pretty fine with Logstash.

1 Like