elasticsearch/docs/reference/security/auditing/index.asciidoc

include::enable-audit-logging.asciidoc[]

include::event-types.asciidoc[]

include::output-logfile.asciidoc[]

include::ignore-policy.asciidoc[]

include::auditing-search-queries.asciidoc[]
[DOCS] Rename auditing topic. Closes #49012 (#49013) * [DOCS] Rename auditing topic. Closes #49012 * Fixed file name, fixed settings link. * Add link to settings 2019-11-14 10:30:11 +08:00			`include::enable-audit-logging.asciidoc[]`
[DOCS] Splits auditing.asciidoc into smaller files 2018-05-24 06:42:51 +08:00
			`include::event-types.asciidoc[]`

			`include::output-logfile.asciidoc[]`

DOC Audit security config change (#66839) Audit log doc changes about: * the new security_config_change event type (main scope of this PR) * remove mentions of the 6.5 audit format changes (the JSON format) * mention the new archiving and rotation by size (in v8 only) * mention the request.id event attribute used to correlate audit events * mention that audit is only available on certain subscription levels * add an exhaustive audit event example list (because schema became too complex to explain in words 😢 given the new security_config_change events) * move the ignore policies are explained on a separate page (it was collocated with the logfile output since we had multiple outputs and the policies were specific the the logfile only). Co-authored-by: Lisa Cawley lcawley@elastic.co Relates #62916 Closes #29912 2021-01-17 01:09:03 +08:00			`include::ignore-policy.asciidoc[]`

DOCS Auditing search queries (#35301) This documents how to include the search queries in the audit log. There is a catch, that even if enabling `emit_request_body`, which should output queries included in request bodies, search queries were not output because, implicitly, no REST layer audit event type was included. This folk knowledge is herein imprinted. 2018-11-09 17:38:45 +08:00			`include::auditing-search-queries.asciidoc[]`