# Audit log fields

**URL:** <https://discuss.elastic.co/t/audit-log-fields/302874>\
**Category:** Logstash\
**Created:** [April 21, 2022, 6:22am UTC](https://discuss.elastic.co/t/audit-log-fields/302874 "2022-04-21T06:22:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [April 21, 2022, 6:22am UTC](https://discuss.elastic.co/t/audit-log-fields/302874/1 "2022-04-21T06:22:19Z")

</div>

Hi, I have a set of audit call events, Example:

```auto
type=SYSCALL msg=audit(1647800652.003:104): arch=c00000b7 syscall=221 success=yes exit=0 a0=ffff96c3a518 a1=ffffe65a32e8 a2=ffffe65a3c78 a3=8 items=0 ppid=5916 pid=7997 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sh" exe="/bin/sh" subj=system_u:system_r:atf_agent_t key=(null)
type=PROCTITLE msg=audit(1647800652.003:104): proctitle=7368002D630069707461626C6573202D4920494E505554202D7020746370202D2D64657374696E6174696F6E2D706F72742038343030202D6A20414343455054
type=AVC msg=audit(1647800652.007:105): avc: denied { getattr } for pid=7997 comm="sh" path="/" dev="sda3" ino=2 scontext=system_u:system_r:atf_agent_t tcontext=system_u:object_r:default_t tclass=dir permissive=1

```

The filter of my logstash conf file is

```auto
filter {
  if [type] == "audit" {
  grok {
    match => { "message" => "type=%{DATA:audit_type}\smsg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\):.*?( msg=\'(?<sub_msg>.*?)\')?$" }
    named_captures_only => true
  }
  kv {
    exclude_keys => ["msg", "type"]
  }
  kv {
    source => "sub_msg"
  }
  date {
    match => ["audit_epoch", "UNIX"]
  }
  mutate {
    rename => [
      "auid", "uid_audit",
      "fsuid", "uid_fs",
      "suid", "uid_set",
      "ses", "session_id"
    ]
    remove_field => ['sub_msg', 'audit_epoch']
  }
}
}

```

For the type = AVC log messages i get the following fields -

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/6/5681646cd4095480382e167a492aad3a4c27b06f.png)  
However for this, I want to add another field called "Action" that will contain the value present in the curly brackets.  
In this case that would be getattr.  
Need help in figuring out how to update the filter to do so.  
help will be appreciated,  
Thanks in advace

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 21, 2022, 6:33pm UTC](https://discuss.elastic.co/t/audit-log-fields/302874/2 "2022-04-21T18:33:21Z")

</div>

You could add

```
grok { match => { "message" => "{ %{WORD:someField} }" } tag_on_failure => [] }
```

---

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [April 25, 2022, 10:46am UTC](https://discuss.elastic.co/t/audit-log-fields/302874/3 "2022-04-25T10:46:06Z")

</div>

that works, thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2022, 10:46am UTC](https://discuss.elastic.co/t/audit-log-fields/302874/4 "2022-05-23T10:46:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.