Getting incomplete request body in Elasticsearch audit log

Elastic Stack Elasticsearch
1

I have executed few security APIs , for those I am getting incomplete request body in Elasticsearch Audit log. Below are the example:

Query 1:

POST /_security/oauth2/token
{
"grant_type": "refresh_token",
"refresh_token": "vLBPvmAB6KvwvJZr27cS"
}

Audit Log:
{"type":"audit", "timestamp":"2023-12-29T10:48:51,458+0530", "cluster.uuid":"N4A0f0IaSEmDKajj14TcPw", "node.name":"node-1", "Home | NODE.ID ":"IiljWrd3Tv2IghTMopvNaA", "host.name":"DESKTOP-S1VTHGS", "host.ip":"9.43.27.251", "event.type":"rest", "event.action":"authentication_success", "authentication.type":"REALM", "user.name":"elastic", "user.realm":"reserved", "origin.type":"rest", "origin.address":"192.168.29.126:51704", "realm":"reserved", "url.path":"/_security/oauth2/token", "request.method":"POST", "request.body":"{"grant_type":"refresh_token"}", "request.id":"OjNA0oFQQUyxnNm7RAJsjA"}

Concern-
( Here we can see in above audit log "refresh_token": "vLBPvmAB6KvwvJZr27cS" this value is not getting in request body )

Query 2:

POST /_security/oauth2/token
{
"grant_type" : "password",
"username" : "test_admin",
"password" : "x-pack-test-password"
}

Audit Log:
{"type":"audit", "timestamp":"2023-12-29T10:48:27,620+0530", "cluster.uuid":"N4A0f0IaSEmDKajj14TcPw", "node.name":"node-1", "Home | NODE.ID ":"IiljWrd3Tv2IghTMopvNaA", "host.name":"DESKTOP-S1VTHGS", "host.ip":"9.43.27.251", "event.type":"rest", "event.action":"authentication_success", "authentication.type":"REALM", "user.name":"elastic", "user.realm":"reserved", "origin.type":"rest", "origin.address":"192.168.29.126:51704", "realm":"reserved", "url.path":"/_security/oauth2/token", "request.method":"POST", "request.body":"{"grant_type":"password","username":"test_admin"}", "request.id":"wSTPJrfVQzGP_oBIxuXOcA"}

Concern-
( Here we can see in above audit log "password" : "x-pack-test-password" this value is not getting in request body )

Please suggest for the above concerns is there anyone we can see complete request body(including confidential data like "password" and "token" etc..) in audit log for above security APIs

2

It is by design that sensitive data is not recorded in the audit log. There shouldn't be a good reason to log these things.

3

thanks for update

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.