in src/main/java/org/opensearch/security/auditlog/impl/RequestResolver.java [159:340]
private static AuditMessage resolveInner(final AuditCategory category,
final String effectiveUser,
final Boolean securityadmin,
final String initiatingUser,
final TransportAddress remoteAddress,
final String action,
final String priv,
final Origin origin,
final Object request,
final Map<String, String> headers,
final Task task,
final IndexNameExpressionResolver resolver,
final ClusterService cs,
final Settings settings,
final boolean logRequestBody,
final boolean resolveIndices,
final String securityIndex,
final boolean excludeSensitiveHeaders,
final Throwable exception) {
final AuditMessage msg = new AuditMessage(category, cs, origin, Origin.TRANSPORT);
msg.addInitiatingUser(initiatingUser);
msg.addEffectiveUser(effectiveUser);
msg.addRemoteAddress(remoteAddress);
msg.addAction(action);
if(request != null) {
msg.addRequestType(request.getClass().getSimpleName());
}
if(securityadmin != null) {
msg.addIsAdminDn(securityadmin);
}
msg.addException(exception);
msg.addPrivilege(priv);
msg.addTransportHeaders(headers, excludeSensitiveHeaders);
if(task != null) {
msg.addTaskId(task.getId());
if(task.getParentTaskId() != null && task.getParentTaskId().isSet()) {
msg.addTaskParentId(task.getParentTaskId().toString());
}
}
//attempt to resolve indices/types/id/source
if (request instanceof MultiGetRequest.Item) {
final MultiGetRequest.Item item = (MultiGetRequest.Item) request;
final String[] indices = arrayOrEmpty(item.indices());
final String id = item.id();
msg.addId(id);
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
} else if (request instanceof CreateIndexRequest) {
final CreateIndexRequest cir = (CreateIndexRequest) request;
final String[] indices = arrayOrEmpty(cir.indices());
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
if (logRequestBody) {
msg.addMapToRequestBody(Utils.convertJsonToxToStructuredMap(cir.settings()));
}
} else if (request instanceof UpdateSettingsRequest) {
final UpdateSettingsRequest usr = (UpdateSettingsRequest) request;
final String[] indices = arrayOrEmpty(usr.indices());
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
if (logRequestBody) {
msg.addMapToRequestBody(Utils.convertJsonToxToStructuredMap(usr.settings()));
}
} else if (request instanceof DeleteIndexRequest) {
final DeleteIndexRequest dir = (DeleteIndexRequest) request;
final String[] indices = arrayOrEmpty(dir.indices());
//dir id alle id's beim schreiben protokolloieren
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
} else if (request instanceof IndexRequest) {
final IndexRequest ir = (IndexRequest) request;
final String[] indices = arrayOrEmpty(ir.indices());
final String id = ir.id();
msg.addShardId(ir.shardId());
msg.addId(id);
addIndicesSourceSafe(msg, indices, resolver, cs, ir.getContentType(), ir.source(), settings, resolveIndices, logRequestBody, true, securityIndex);
} else if (request instanceof DeleteRequest) {
final DeleteRequest dr = (DeleteRequest) request;
final String[] indices = arrayOrEmpty(dr.indices());
final String id = dr.id();
msg.addShardId(dr.shardId());
msg.addId(id);
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
} else if (request instanceof UpdateRequest) {
final UpdateRequest ur = (UpdateRequest) request;
final String[] indices = arrayOrEmpty(ur.indices());
final String id = ur.id();
msg.addId(id);
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
if(logRequestBody) {
if (ur.doc() != null) {
msg.addTupleToRequestBody(ur.doc() == null ? null :convertSource(ur.doc().getContentType(), ur.doc().source()));
}
if (ur.script() != null) {
msg.addMapToRequestBody(ur.script() == null ? null : Utils.convertJsonToxToStructuredMap(ur.script()));
}
}
} else if (request instanceof GetRequest) {
final GetRequest gr = (GetRequest) request;
final String[] indices = arrayOrEmpty(gr.indices());
final String id = gr.id();
msg.addId(id);
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
} else if (request instanceof SearchRequest) {
final SearchRequest sr = (SearchRequest) request;
final String[] indices = arrayOrEmpty(sr.indices());
Map<String, Object> sourceAsMap = sr.source() == null? null:Utils.convertJsonToxToStructuredMap(sr.source());
addIndicesSourceSafe(msg, indices, resolver, cs, XContentType.JSON, sourceAsMap, settings, resolveIndices, logRequestBody, false, securityIndex);
} else if (request instanceof ClusterUpdateSettingsRequest) {
if(logRequestBody) {
final ClusterUpdateSettingsRequest cusr = (ClusterUpdateSettingsRequest) request;
final Settings persistentSettings = cusr.persistentSettings();
final Settings transientSettings = cusr.transientSettings();
XContentBuilder builder = null;
try {
builder = XContentFactory.jsonBuilder();
builder.startObject();
if(persistentSettings != null) {
builder.field("persistent_settings", Utils.convertJsonToxToStructuredMap(persistentSettings));
}
if(transientSettings != null) {
builder.field("transient_settings", Utils.convertJsonToxToStructuredMap(persistentSettings));
}
builder.endObject();
msg.addUnescapedJsonToRequestBody(builder == null?null:Strings.toString(builder));
} catch (IOException e) {
log.error(e.toString());
} finally {
if(builder != null) {
builder.close();
}
}
}
} else if (request instanceof ReindexRequest) {
final IndexRequest ir = ((ReindexRequest) request).getDestination();
final String[] indices = arrayOrEmpty(ir.indices());
final String id = ir.id();
msg.addShardId(ir.shardId());
msg.addId(id);
addIndicesSourceSafe(msg, indices, resolver, cs, ir.getContentType(), ir.source(), settings, resolveIndices, logRequestBody, true, securityIndex);
} else if (request instanceof DeleteByQueryRequest) {
final DeleteByQueryRequest ir = (DeleteByQueryRequest) request;
final String[] indices = arrayOrEmpty(ir.indices());
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
} else if (request instanceof UpdateByQueryRequest) {
final UpdateByQueryRequest ir = (UpdateByQueryRequest) request;
final String[] indices = arrayOrEmpty(ir.indices());
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
} else if (request instanceof PutMappingRequest) {
final PutMappingRequest pr = (PutMappingRequest) request;
final Index ci = pr.getConcreteIndex();
String[] indices = new String[0];
msg.addIndices(indices);
if(ci != null) {
indices = new String[]{ci.getName()};
}
if(logRequestBody) {
msg.addUnescapedJsonToRequestBody(pr.source());
}
if(resolveIndices) {
msg.addResolvedIndices(indices);
}
} else if (request instanceof IndicesRequest) { //less specific
final IndicesRequest ir = (IndicesRequest) request;
final String[] indices = arrayOrEmpty(ir.indices());
addIndicesSourceSafe(msg, indices, resolver, cs, null, null, settings, resolveIndices, logRequestBody, false, securityIndex);
}
return msg;
}