Extract Individual Fields from Audit Log

[Michael A Grady]

> On Mar 16, 2017, at 6:51 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
> On 3/16/17, 7:32 PM, "users on behalf of Strickland, David R" <users-bounces at shibboleth.net <mailto:users-bounces at shibboleth.net> on behalf of dstrickland at austin.utexas.edu <mailto:dstrickland at austin.utexas.edu>> wrote:
> 
>> I know the format of %msg (available in logback.xml) is hard-coded, but is there any way I can get to these fields individually,
>> perhaps with a custom field extraction bean?
> 
> That's what you would have to do, the field extractors I built don't have any idea how to do that. The extractors literally supply the string to output, they would have to know how to include that prefix.
> 
>> My use-case is that our Splunk service automatically indexes fields with the name=value syntax. While I can have Splunk
>> extract these fields with a regular expression, it can get pretty expensive to run those searches.
> 
> We have Splunk (and they're using a regex of course), and they haven't mentioned to me that it impacts search time. I would have assumed Splunk just precooks all that, are you sure it would speed up searches? Not saying you're wrong.
> 
> Anyway, you're welcome to add a RFE for that, it's probably something I can add generically.
> 
> -- Scott


Perhaps I'm not understanding what David wants to do, but couldn't you do that for the audit log by modifying the AuditFormattingMap in conf/audit.xml?

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170316/8371bc53/attachment.html>