Audit Elasticsearch HTTP request bodies

Elasticsearch can include the body of an authenticated REST request in its authentication_success audit event. Request bodies can contain search queries, indexing operations, security configuration changes, or payloads sent to other REST APIs.

Note

To trace and analyze queries, use query logging. Request body auditing can capture query payloads, but it associates the HTTP body with a security audit event and doesn't provide query-specific fields such as duration, outcome, or targeted indices. If query logging isn't available, request body auditing can help identify submitted queries.

Include request bodies in audit events

To include request bodies, configure the following setting in Elasticsearch:

xpack.security.audit.logfile.events.emit_request_body: true

You can apply this setting through cluster update settings API, as described in Configure audit logging. Alternatively, you can modify elasticsearch.yml in all nodes and restart for the changes to take effect.

The request body is available only on the authentication_success event generated by the REST layer on the coordinating node. This event isn't included by default. Add authentication_success to the existing xpack.security.audit.logfile.events.include list to capture request bodies while preserving the other event types that you audit.

Important

Request bodies can contain sensitive data. Although Elasticsearch filters credentials from audited security APIs, other sensitive data might be recorded in plain text. A request body can also contain malicious content that breaks a parser consuming the audit logs.

Request body fields

How Elasticsearch records the request body depends on its content type:

request.body: For request bodies that Elasticsearch can represent as JSON, contains the full body as an escaped JSON string. Elasticsearch converts supported structured formats, such as YAML, to JSON. If you collect audit logs with the Elasticsearch integration or the Filebeat Elasticsearch module, the ingest pipeline maps request.body to the Elastic Common Schema (ECS) field http.request.body.content in indexed documents.
request.raw_body: Contains the request body as a Base64-encoded string when Elasticsearch can't represent it as JSON, such as for Protobuf telemetry payloads. Elasticsearch emits this field instead of request.body. The audit event records the content type in request.raw_body_content_type. If the request specifies a content encoding, the audit event records it in request.raw_body_content_encoding.

For complete field descriptions, refer to audit event types.