Audit Log Exclude by Origin / Principal

lask001 · January 25, 2018, 2:00am

I haven't been able to get any of the combinations in that thread to work for me. I've tried things like:

.*elastic*.*, .*principal=.elastic.,.*, .principal=\[elastic\]., .principal=\\[elastic\\]., .*principal=\[elastic\].*

Any suggestions, or do you see what I'm missing?

Topic		Replies	Views
Log4j regex filter to avoid audit logs Elasticsearch elastic-stack-security	3	942	April 29, 2020
AuditLog index filtering problem Elasticsearch elastic-stack-security	2	411	February 4, 2019
Audit log flexability Elasticsearch	5	541	February 14, 2018
6.4 xpack.security.audit.logfile.events.ignore_filters.*.realms broken? Elasticsearch	9	1227	January 17, 2019
Exclude user from security audit logging? (logstash's elasticsearch output user) Elasticsearch	1	845	June 21, 2017