<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi Pavol,</p>
<p><br>
</p>
<p>I had not looked in midPoint sources yet, so thanks for the pointer to the AuditService implementation. It does indeed look encouragingly simple so I think we will go the custom AuditService route.</p>
<p><br>
</p>
<p>To answer my question about logging to logstash, it was really quite simple to configure filebeat to send off midPoint logs to logstash. Below is a filebeat configuration file that works with midPoint audit log with details included. The multi line log entries
are split at timestamps, and shipped to a logging server listening at host 'elk' port 5044.
<br>
</p>
<p><br>
</p>
<p>/etc/filebeat/filebeat.yml<br>
</p>
<p><br>
</p>
<p>output:<br>
logstash:<br>
enabled: true<br>
hosts:<br>
- elk:5044<br>
ssl:<br>
certificate_authorities:<br>
- /etc/pki/tls/certs/logstash-beats.crt<br>
timeout: 15<br>
<br>
filebeat:<br>
prospectors:<br>
-<br>
paths:<br>
- /opt/apache-tomcat/logs/idm-profile.log<br>
multiline:<br>
pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'<br>
negate: true<br>
match: after</p>
<p><br>
</p>
<p>-- </p>
<p>Pertti</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);"></div>
</body>
</html>