elastic / elastic/docs-content

[Website]: Audit logs "request_body" output field

Open
#3,010 0 comments 0 reactions 0 assignees View on GitHub
Confidence: 1 Effort: 0.1 Impact: 2 Reach: 3 source:web Team:Admin
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 21h
Merged PRs (30d)
141

Description

### Type of issue

Inaccurate

### What documentation page is affected

https://www.elastic.co/docs/deploy-manage/security/logging-configuration/auditing-search-queries

### What happened?

The documentation refers to a `request.body` attribute. As a end user, I would expect the final document to have the field. Instead the body is added to the field `http.request.body.content` (in Elasticsearch) which can be confusing.

Tested on ECH v9.1.2. I don't have access to the original log to know if logs is generated this way or transformed in later on.

### Additional info

_No response_

## Action
added by (@georgewallace)

This might be being returned in a place we don't expect

- Research what is the correct attribute and update the documentation

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.