Custom audit log development

Elasticsearch version: 8.19.15

Describe the issue: Custom audit sink are hard to develop

I am developing a custom storage for audit logs. It appears, at first glance, that the documentation is outdated. It mentions inheriting from the class com.floragunn.searchguard.auditlog.impl.AbstractAuditLog, whereas in reality it is the class com.floragunn.searchguard.enterprise.auditlog.sink.AuditLogSink that must be the parent class. Furthermore, it is not possible to add custom settings; the exhaustive list is resolved in com.floragunn.searchguard.SearchGuardPlugin#getSettings, and there is no way to inject custom attributes, which is quite problematic.

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.