Oracle fields
editOracle fields
editOracle Module
oracle
editFields from Oracle logs.
database_audit
editModule for parsing Oracle Database audit logs
-
oracle.database_audit.status
-
Database Audit Status.
type: keyword
-
oracle.database_audit.session_id
-
Indicates the audit session ID number.
type: keyword
-
oracle.database_audit.client.terminal
-
If available, the client terminal type, for example "pty".
type: keyword
-
oracle.database_audit.client.address
-
The IP Address or Domain used by the client.
type: keyword
-
oracle.database_audit.client.user
-
The user running the client or connection to the database.
type: keyword
-
oracle.database_audit.database.user
-
The database user used to authenticate.
type: keyword
-
oracle.database_audit.privilege
-
The privilege group related to the database user.
type: keyword
-
oracle.database_audit.entry.id
-
Indicates the current audit entry number, assigned to each audit trail record. The audit entry.id sequence number is shared between fine-grained audit records and regular audit records.
type: keyword
-
oracle.database_audit.database.host
-
Client host machine name.
type: keyword
-
oracle.database_audit.action
-
The action performed during the audit event. This could for example be the raw query.
type: keyword
-
oracle.database_audit.action_number
-
Action is a numeric value representing the action the user performed. The corresponding name of the action type is in the AUDIT_ACTIONS table. For example, action 100 refers to LOGON.
type: keyword
-
oracle.database_audit.database.id
-
Database identifier calculated when the database is created. It corresponds to the DBID column of the V$DATABASE data dictionary view.
type: keyword
-
oracle.database_audit.length
-
Refers to the total number of bytes used in this audit record. This number includes the trailing newline bytes (\n), if any, at the end of the audit record.
type: long