# Parsing of audit log

**URL:** <https://discuss.elastic.co/t/parsing-of-audit-log/165184>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [January 22, 2019, 8:32am UTC](https://discuss.elastic.co/t/parsing-of-audit-log/165184 "2019-01-22T08:32:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![li\_jessen2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/li_jessen2016/32/38817_2.png) [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)\
**Post date:** [January 22, 2019, 8:32am UTC](https://discuss.elastic.co/t/parsing-of-audit-log/165184/1 "2019-01-22T08:32:15Z")

</div>

I got the following from logfile:

"event.type":"transport", "event.action":"access\_granted", "user.name":"\_xpack\_security", "user.realm":"\_\_attach", "user.roles":["superuser"], "origin.type":"local\_node", "origin.address":"10.161.65.23:9300", "action":"cluster:admin/xpack/security/realm/cache/clear[n]", "request.name":"Node"}

Can anybody summarize the main purpose of this event? It is a cache clear action initiated by xpack\_security to the cluster?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [January 25, 2019, 5:22am UTC](https://discuss.elastic.co/t/parsing-of-audit-log/165184/2 "2019-01-25T05:22:08Z")

</div>

Hi Li,

Correct, this is indication of the realm cache being cleared. There are a number of cases that could trigger this including, but not limited to:

- role mapping changes
- native/reserved user modification ( password change, user property change, user enabled/disabled)

If this was triggered by a call to the [clear cache API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-clear-cache.html), you'd get an `"origin.type": "rest"`and `"user.name"` would reflect the user that called the API

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2019, 5:23am UTC](https://discuss.elastic.co/t/parsing-of-audit-log/165184/3 "2019-02-22T05:23:50Z")

</div>

Closed on February 22, 2019, 5:23am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.