Read History Audit Logging - blacklisting indices

Search Guard
1

Hi,

I have been using Search Guard Compliance Plugin (Beta For ElasticSearch 6.2.2) and I have a trouble with blacklisting indices using provided configuration syntax for this module.

What I would like to achieve is to monitor all indices except ones that have “dot” at the beginning (e.g. .monitoring-). There is a possibility to use wildcards for “searchguard.compliance.history.read.watched_fields” option so I can set it to - ".", but I do not know how to set it to prevent search guard from adding information about .monitroing- indices.

Maybe I can use “searchguard.audit.ignore_requests” for this purpose?

Link to documentation - Read History | Elasticsearch Security | Search Guard

Thanks!
Dan

2

searchguard.compliance.history.read.watched_fields: '/(?!\.).+/'

This should watch all fields for all indicies for which the indices start not with a dot. You can use regex for index and fields.
But normally we recommend to list each index and the respective fields separately because watching many indices and many fields would slow down elasticsearch.

···

Am 18.04.2018 um 13:44 schrieb Dan S <salbert.dan@gmail.com>:

Hi,

I have been using Search Guard Compliance Plugin (Beta For ElasticSearch 6.2.2) and I have a trouble with blacklisting indices using provided configuration syntax for this module.
What I would like to achieve is to monitor all indices except ones that have "dot" at the beginning (e.g. .monitoring-*). There is a possibility to use wildcards for "searchguard.compliance.history.read.watched_fields" option so I can set it to - "*.*", but I do not know how to set it to prevent search guard from adding information about .monitroing-* indices.

Maybe I can use "searchguard.audit.ignore_requests" for this purpose?
  
Link to documentation - Read History | Elasticsearch Security | Search Guard

Thanks!
Dan

--
You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
To post to this group, send email to search-guard@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/f0e4afcb-7526-4b67-a0b2-cc19f97510db%40googlegroups.com\.
For more options, visit https://groups.google.com/d/optout\.