aws-opensearch-application-audit-log-event
OpenSearch logs can contain query text, request paths, user identities, and application errors with document values.
Where it sits
| location | CloudWatch Logs OpenSearch application/search-slow/index-slow/audit event.message |
|---|
| location kind | log_field |
|---|
| data kinds | credential password api_key bearer_token customer_data pii |
|---|
| emits edge | ContainsSecret |
|---|
| service | OpenSearch (aws:opensearch) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | logs:FilterLogEvents |
|---|
| response path | Events[].Message |
|---|
| encoding | string |
|---|
| params | {"LogGroupName": "\u003copensearch-log-group\u003e"} |
|---|
Required permissions
logs:FilterLogEvents
es:DescribeDomainConfig
References