# Ship audit log entries retrieved via REST

**URL:** <https://discuss.elastic.co/t/ship-audit-log-entries-retrieved-via-rest/93615>\
**Category:** Logstash\
**Created:** [July 18, 2017, 3:25pm UTC](https://discuss.elastic.co/t/ship-audit-log-entries-retrieved-via-rest/93615 "2017-07-18T15:25:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adam\_Szabo](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@Adam\_Szabo](https://discuss.elastic.co/u/Adam_Szabo)\
**Post date:** [July 18, 2017, 3:25pm UTC](https://discuss.elastic.co/t/ship-audit-log-entries-retrieved-via-rest/93615/1 "2017-07-18T15:25:16Z")

</div>

Confluence's audit log is only available via

- [the management UI](https://confluence.atlassian.com/crowd/browsing-the-audit-log-890749381.html)
- [REST](https://docs.atlassian.com/atlassian-confluence/REST/5.10.6/#audit)

What would be a good solution to ship these entries to Elasticsearch?

I had a look at the [http\_poller](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http_poller.html) input plugin.  
While it looks like a good candidate, I'd have to re-read all the audit events everytime.  
I'd need something like an internal counter so that I could use the query parameter [start](https://docs.atlassian.com/atlassian-confluence/REST/5.10.6/#audit-getAuditRecords) to limit where the results should begin.

---

<div class="post-metadata">

**Author:** ![Adam\_Szabo](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@Adam\_Szabo](https://discuss.elastic.co/u/Adam_Szabo)\
**Post date:** [July 19, 2017, 7:05am UTC](https://discuss.elastic.co/t/ship-audit-log-entries-retrieved-via-rest/93615/2 "2017-07-19T07:05:00Z")

</div>

I think I have a possible solution, which is not overcomplicated.

I can use [this API](https://docs.atlassian.com/atlassian-confluence/REST/5.10.6/#audit-getAuditRecords) to get the records from the last hour for example.

In the http\_poller I call this API every hour.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2017, 7:05am UTC](https://discuss.elastic.co/t/ship-audit-log-entries-retrieved-via-rest/93615/3 "2017-08-16T07:05:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.