|
| 1 | +{% raw %} |
| 2 | +# Log4j CUSTOM FILE |
| 3 | + |
| 4 | +status = error |
| 5 | +logger.action.name = org.elasticsearch.action |
| 6 | +logger.action.level = debug |
| 7 | +appender.rolling.type = Console |
| 8 | +appender.rolling.name = rolling |
| 9 | +appender.rolling.layout.type = ESJsonLayout |
| 10 | +appender.rolling.layout.type_name = server |
| 11 | +rootLogger.level = info |
| 12 | +rootLogger.appenderRef.rolling.ref = rolling |
| 13 | +appender.deprecation_rolling.type = Console |
| 14 | +appender.deprecation_rolling.name = deprecation_rolling |
| 15 | +appender.deprecation_rolling.layout.type = ESJsonLayout |
| 16 | +appender.deprecation_rolling.layout.type_name = deprecation |
| 17 | +appender.deprecation_rolling.layout.esmessagefields=x-opaque-id |
| 18 | +logger.deprecation.name = org.elasticsearch.deprecation |
| 19 | +logger.deprecation.level = warn |
| 20 | +logger.deprecation.appenderRef.deprecation_rolling.ref = deprecation_rolling |
| 21 | +logger.deprecation.additivity = false |
| 22 | +appender.index_search_slowlog_rolling.type = Console |
| 23 | +appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling |
| 24 | +appender.index_search_slowlog_rolling.layout.type = ESJsonLayout |
| 25 | +appender.index_search_slowlog_rolling.layout.type_name = index_search_slowlog |
| 26 | +appender.index_search_slowlog_rolling.layout.esmessagefields=message,took,took_millis,total_hits,stats,search_type,total_shards,source,id |
| 27 | +logger.index_search_slowlog_rolling.name = index.search.slowlog |
| 28 | +logger.index_search_slowlog_rolling.level = trace |
| 29 | +logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling |
| 30 | +logger.index_search_slowlog_rolling.additivity = false |
| 31 | +appender.index_indexing_slowlog_rolling.type = Console |
| 32 | +appender.index_indexing_slowlog_rolling.name = index_indexing_slowlog_rolling |
| 33 | +appender.index_indexing_slowlog_rolling.layout.type = ESJsonLayout |
| 34 | +appender.index_indexing_slowlog_rolling.layout.type_name = index_indexing_slowlog |
| 35 | +appender.index_indexing_slowlog_rolling.layout.esmessagefields=message,took,took_millis,doc_type,id,routing,source |
| 36 | +logger.index_indexing_slowlog.name = index.indexing.slowlog.index |
| 37 | +logger.index_indexing_slowlog.level = trace |
| 38 | +logger.index_indexing_slowlog.appenderRef.index_indexing_slowlog_rolling.ref = index_indexing_slowlog_rolling |
| 39 | +logger.index_indexing_slowlog.additivity = false |
| 40 | +appender.audit_rolling.type = Console |
| 41 | +appender.audit_rolling.name = audit_rolling |
| 42 | +appender.audit_rolling.layout.type = PatternLayout |
| 43 | +appender.audit_rolling.layout.pattern = {\ |
| 44 | +"type": "audit", \ |
| 45 | +"timestamp":"%d{yyyy-MM-dd'T'HH:mm:ss,SSSZ}"\ |
| 46 | +%varsNotEmpty{, "node.name":"%enc{%map{node.name}}{JSON}"}\ |
| 47 | +%varsNotEmpty{, "node.id":"%enc{%map{node.id}}{JSON}"}\ |
| 48 | +%varsNotEmpty{, "host.name":"%enc{%map{host.name}}{JSON}"}\ |
| 49 | +%varsNotEmpty{, "host.ip":"%enc{%map{host.ip}}{JSON}"}\ |
| 50 | +%varsNotEmpty{, "event.type":"%enc{%map{event.type}}{JSON}"}\ |
| 51 | +%varsNotEmpty{, "event.action":"%enc{%map{event.action}}{JSON}"}\ |
| 52 | +%varsNotEmpty{, "user.name":"%enc{%map{user.name}}{JSON}"}\ |
| 53 | +%varsNotEmpty{, "user.run_by.name":"%enc{%map{user.run_by.name}}{JSON}"}\ |
| 54 | +%varsNotEmpty{, "user.run_as.name":"%enc{%map{user.run_as.name}}{JSON}"}\ |
| 55 | +%varsNotEmpty{, "user.realm":"%enc{%map{user.realm}}{JSON}"}\ |
| 56 | +%varsNotEmpty{, "user.run_by.realm":"%enc{%map{user.run_by.realm}}{JSON}"}\ |
| 57 | +%varsNotEmpty{, "user.run_as.realm":"%enc{%map{user.run_as.realm}}{JSON}"}\ |
| 58 | +%varsNotEmpty{, "user.roles":%map{user.roles}}\ |
| 59 | +%varsNotEmpty{, "origin.type":"%enc{%map{origin.type}}{JSON}"}\ |
| 60 | +%varsNotEmpty{, "origin.address":"%enc{%map{origin.address}}{JSON}"}\ |
| 61 | +%varsNotEmpty{, "realm":"%enc{%map{realm}}{JSON}"}\ |
| 62 | +%varsNotEmpty{, "url.path":"%enc{%map{url.path}}{JSON}"}\ |
| 63 | +%varsNotEmpty{, "url.query":"%enc{%map{url.query}}{JSON}"}\ |
| 64 | +%varsNotEmpty{, "request.method":"%enc{%map{request.method}}{JSON}"}\ |
| 65 | +%varsNotEmpty{, "request.body":"%enc{%map{request.body}}{JSON}"}\ |
| 66 | +%varsNotEmpty{, "request.id":"%enc{%map{request.id}}{JSON}"}\ |
| 67 | +%varsNotEmpty{, "action":"%enc{%map{action}}{JSON}"}\ |
| 68 | +%varsNotEmpty{, "request.name":"%enc{%map{request.name}}{JSON}"}\ |
| 69 | +%varsNotEmpty{, "indices":%map{indices}}\ |
| 70 | +%varsNotEmpty{, "opaque_id":"%enc{%map{opaque_id}}{JSON}"}\ |
| 71 | +%varsNotEmpty{, "x_forwarded_for":"%enc{%map{x_forwarded_for}}{JSON}"}\ |
| 72 | +%varsNotEmpty{, "transport.profile":"%enc{%map{transport.profile}}{JSON}"}\ |
| 73 | +%varsNotEmpty{, "rule":"%enc{%map{rule}}{JSON}"}\ |
| 74 | +%varsNotEmpty{, "event.category":"%enc{%map{event.category}}{JSON}"}\ |
| 75 | +}%n |
| 76 | +logger.xpack_security_audit_logfile.name = org.elasticsearch.xpack.security.audit.logfile.LoggingAuditTrail |
| 77 | +logger.xpack_security_audit_logfile.level = info |
| 78 | +logger.xpack_security_audit_logfile.appenderRef.audit_rolling.ref = audit_rolling |
| 79 | +logger.xpack_security_audit_logfile.additivity = false |
| 80 | +logger.xmlsig.name = org.apache.xml.security.signature.XMLSignature |
| 81 | +logger.xmlsig.level = error |
| 82 | +logger.samlxml_decrypt.name = org.opensaml.xmlsec.encryption.support.Decrypter |
| 83 | +logger.samlxml_decrypt.level = fatal |
| 84 | +logger.saml2_decrypt.name = org.opensaml.saml.saml2.encryption.Decrypter |
| 85 | +logger.saml2_decrypt.level = fatal |
| 86 | +{% endraw %} |
0 commit comments