Class OpenSearchAuditBackend

All Implemented Interfaces:
AuditBackend, AuditAdmin, AuditLogger<LogEntry>, AuditReader<LogEntry>, AuditStorage, Logs<LogEntry>, AuditBackend<LogEntry>

public class OpenSearchAuditBackend extends AbstractAuditBackend
Implementation of the AuditBackend interface using OpenSearch persistence
Author:
tiry
  • Field Details

  • Constructor Details

  • Method Details

    • queryLogs

      public LogEntryList queryLogs(QueryBuilder builder)
      Description copied from interface: AuditBackend
      Returns the logs given a collection of predicates and a default sort.
      Parameters:
      builder - the query builder to fetch log entries
      Returns:
      a list of log entries
    • createSearchRequestSource

      protected org.opensearch.search.builder.SearchSourceBuilder createSearchRequestSource(MultiExpression predicate, OrderByList orders)
    • createQueryBuilder

      protected org.opensearch.index.query.QueryBuilder createQueryBuilder(Predicate queryPredicate)
    • buildLogEntries

      protected LogEntryList buildLogEntries(org.opensearch.action.search.SearchResponse searchResponse)
    • createSearchRequest

      protected org.opensearch.action.search.SearchRequest createSearchRequest()
    • getLogEntryByID

      public LogEntry getLogEntryByID(long id)
      Description copied from interface: AuditBackend
      Returns a given log entry given its id.
      Parameters:
      id - the log entry identifier
      Returns:
      a LogEntry instance
    • buildQuery

      public org.opensearch.action.search.SearchRequest buildQuery(String query, Map<String,Object> params)
    • createSearchSourceBuilder

      protected org.opensearch.search.builder.SearchSourceBuilder createSearchSourceBuilder(String query)
    • expandQueryVariables

      public String expandQueryVariables(String query, Object[] params)
    • expandQueryVariables

      public String expandQueryVariables(String query, Map<String,Object> params)
    • nativeQuery

      public List<?> nativeQuery(String query, Map<String,Object> params, int pageNb, int pageSize)
      Description copied from interface: AuditReader
      Returns a batched list of entries.
      Parameters:
      query - a JPA query language query if implementation of audit backend is JPA (< 7.3 or audit.elasticsearch.enabled=false) and JSON if implementation is Elasticsearch
      params - parameters for the query
      pageNb - the page number (starts at 1)
      pageSize - the number of results per page
    • addLogEntries

      public void addLogEntries(List<LogEntry> entries)
      Description copied from interface: AuditBackend
      Adds given log entries.
      Parameters:
      entries - the list of log entries.
    • getEventsCount

      public Long getEventsCount(String eventId)
    • search

      public org.opensearch.action.search.SearchResponse search(org.opensearch.action.search.SearchRequest request)
    • buildFilter

      protected org.opensearch.index.query.QueryBuilder buildFilter(PredicateDefinition[] predicates, DocumentModel searchDocumentModel)
    • convertDate

      protected Object convertDate(Object o)
    • buildSearchQuery

      public org.opensearch.action.search.SearchRequest buildSearchQuery(String fixedPart, PredicateDefinition[] predicates, DocumentModel searchDocumentModel)
    • isNonNullParam

      protected boolean isNonNullParam(Object[] val)
    • runNextScroll

      protected org.opensearch.action.search.SearchResponse runNextScroll(String scrollId, org.opensearch.common.unit.TimeValue keepAlive)
    • logSearchResponse

      protected void logSearchResponse(org.opensearch.action.search.SearchResponse response)
    • logSearchRequest

      protected void logSearchRequest(org.opensearch.action.search.SearchRequest request)
    • initUIDSequencer

      protected static void initUIDSequencer(OpenSearchClient esClient, String indexName)
      Ensures the audit sequence returns an UID greater or equal than the maximum log entry id.
    • getIndexName

      public String getIndexName()
    • append

      public void append(List<String> jsonEntries)
      Specified by:
      append in interface AuditStorage
      Overrides:
      append in class AbstractAuditBackend
    • scroll

      public ScrollResult<String> scroll(QueryBuilder builder, int batchSize, int keepAliveSeconds)
      Specified by:
      scroll in interface AuditStorage
      Overrides:
      scroll in class AbstractAuditBackend
    • scroll

      public ScrollResult<String> scroll(String scrollId)
      Specified by:
      scroll in interface AuditStorage
      Overrides:
      scroll in class AbstractAuditBackend
    • getLatestLogId

      public long getLatestLogId(String repositoryId, String... eventIds)
      Description copied from interface: AuditBackend
      Returns the latest log id matching events and repository or 0 when no match found.
    • getLatestLogIdAfterDate

      protected String getLatestLogIdAfterDate()
    • clearEntries

      protected void clearEntries()
      Description copied from class: AbstractAuditBackend
      INTERNAL METHOD FOR TESTS, DO NOT USE.
      Overrides:
      clearEntries in class AbstractAuditBackend
    • makeStartsWithQuery

      protected static org.opensearch.index.query.QueryBuilder makeStartsWithQuery(String name, Object value)
    • hasCapability

      public boolean hasCapability(AuditBackend.Capability capability)
      Description copied from interface: AuditBackend
      Checks whether the backend has the capability.