-
Notifications
You must be signed in to change notification settings - Fork 24.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rename and deprecated prefix
logfile audit setting names
#34475
Rename and deprecated prefix
logfile audit setting names
#34475
Conversation
Pinging @elastic/es-security |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The changes LGTM. When you backport we need to document the deprecation of these settings in the migrate_6_5.asciidoc file. Also, please open a followup PR that removes the deprecated settings from master and documents the removal as a breaking change for 7.0
The logfile audit log format is no longer formed by prefix fields followed by key value fields, it is all formed by key value fields only (JSON format). Consequently, the following settings, which toggled some of the prefix fields, have been renamed by splicing out the prefix component: - xpack.security.audit.logfile.prefix.emit_node_host_address - xpack.security.audit.logfile.prefix.emit_node_host_name - xpack.security.audit.logfile.prefix.emit_node_name
The logfile audit log format is no longer formed by prefix fields followed by key value fields, it is all formed by key value fields only (JSON format). Consequently, the following settings, which toggled some of the prefix fields, have been renamed: audit.logfile .prefix.emit_node_host_address audit.logfile .prefix.emit_node_host_name audit.logfile .prefix.emit_node_name
#31931 Changed the format of the logfile audit log.
It is no longer formed by prefix fields followed by key value fields, it is all formed by key value fields only (JSON format).
Consequently, the following settings, which toggled some of the prefix fields, should be renamed:
audit.logfile
.prefix.emit_node_host_addressaudit.logfile
.prefix.emit_node_host_nameaudit.logfile
.prefix.emit_node_nameThe prefix variants have been deprecated (in 7.0 also?) in favor of the variants lacking the prefix. .
The setting
audit.logfile.prefix.emit_node_id
which has not seen the release light has simply been renamed toaudit.logfile.emit_node_id
.Relates #31931 (should have been considered there).