You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/elasticsearch/configuration-reference/auding-settings.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,7 +24,7 @@ If configured, auditing settings must be set on every node in the cluster. Stati
24
24
25
25
$$$xpack-security-audit-enabled$$$
26
26
27
-
`xpack.security.audit.enabled`
27
+
`xpack.security.audit.enabled`
28
28
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Set to `true` to enable auditing on the node. The default value is `false`. This puts the auditing events in a dedicated file named `<clustername>_audit.json` on each node.
29
29
30
30
If enabled, this setting must be configured in `elasticsearch.yml` on all nodes in the cluster.
@@ -37,17 +37,17 @@ The events and some other information about what gets logged can be controlled b
37
37
38
38
$$$xpack-sa-lf-events-include$$$
39
39
40
-
`xpack.security.audit.logfile.events.include`
40
+
`xpack.security.audit.logfile.events.include`
41
41
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies the [kind of events](/reference/elasticsearch/elasticsearch-audit-events.md) to print in the auditing output. In addition, `_all` can be used to exhaustively audit all the events, but this is usually discouraged since it will get very verbose. The default list value contains: `access_denied, access_granted, anonymous_access_denied, authentication_failed, connection_denied, tampered_request, run_as_denied, run_as_granted, security_config_change`.
42
42
43
43
$$$xpack-sa-lf-events-exclude$$$
44
44
45
-
`xpack.security.audit.logfile.events.exclude`
45
+
`xpack.security.audit.logfile.events.exclude`
46
46
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Excludes the specified [kind of events](/reference/elasticsearch/elasticsearch-audit-events.md) from the include list. This is useful in the case where the `events.include` setting contains the special value `_all`. The default is the empty list.
47
47
48
48
$$$xpack-sa-lf-events-emit-request$$$
49
49
50
-
`xpack.security.audit.logfile.events.emit_request_body`
50
+
`xpack.security.audit.logfile.events.emit_request_body`
51
51
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the full request body from REST requests as an attribute of certain kinds of audit events. This setting can be used to [audit search queries](docs-content://deploy-manage/monitor/logging-configuration/auditing-search-queries.md).
52
52
53
53
The default value is `false`, so request bodies are not printed.
`xpack.security.audit.logfile.emit_node_name`
65
+
`xpack.security.audit.logfile.emit_node_name`
66
66
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the [node name](docs-content://deploy-manage/deploy/self-managed/important-settings-configuration.md#node-name) as a field in each audit event. The default value is `false`.
67
67
68
68
$$$xpack-sa-lf-emit-node-host-address$$$
69
69
70
-
`xpack.security.audit.logfile.emit_node_host_address`
70
+
`xpack.security.audit.logfile.emit_node_host_address`
71
71
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node’s IP address as a field in each audit event. The default value is `false`.
72
72
73
73
$$$xpack-sa-lf-emit-node-host-name$$$
74
74
75
-
`xpack.security.audit.logfile.emit_node_host_name`
75
+
`xpack.security.audit.logfile.emit_node_host_name`
76
76
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node’s host name as a field in each audit event. The default value is `false`.
77
77
78
78
$$$xpack-sa-lf-emit-node-id$$$
79
79
80
-
`xpack.security.audit.logfile.emit_node_id`
80
+
`xpack.security.audit.logfile.emit_node_id`
81
81
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Specifies whether to include the node id as a field in each audit event. Unlike [node name](docs-content://deploy-manage/deploy/self-managed/important-settings-configuration.md#node-name), whose value might change if the administrator changes the setting in the config file, the node id will persist across cluster restarts and the administrator cannot change it. The default value is `true`.
82
82
83
83
@@ -87,27 +87,27 @@ The following settings affect the [ignore policies](docs-content://deploy-manage
87
87
88
88
$$$xpack-sa-lf-events-ignore-users$$$
89
89
90
-
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.users`
90
+
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.users`
91
91
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of user names or wildcards. The specified policy will not print audit events for users matching these values.
92
92
93
93
$$$xpack-sa-lf-events-ignore-realms$$$
94
94
95
-
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.realms`
95
+
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.realms`
96
96
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of authentication realm names or wildcards. The specified policy will not print audit events for users in these realms.
97
97
98
98
$$$xpack-sa-lf-events-ignore-actions$$$
99
99
100
-
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.actions`
100
+
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.actions`
101
101
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of action names or wildcards. Action name can be found in the `action` field of the audit event. The specified policy will not print audit events for actions matching these values.
102
102
103
103
$$$xpack-sa-lf-events-ignore-roles$$$
104
104
105
-
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.roles`
105
+
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.roles`
106
106
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of role names or wildcards. The specified policy will not print audit events for users that have these roles. If the user has several roles, some of which are **not** covered by the policy, the policy will **not** cover this event.
107
107
108
108
$$$xpack-sa-lf-events-ignore-indices$$$
109
109
110
-
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.indices`
110
+
`xpack.security.audit.logfile.events.ignore_filters.<policy_name>.indices`
111
111
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A list of index names or wildcards. The specified policy will not print audit events when all the indices in the event match these values. If the event concerns several indices, some of which are **not** covered by the policy, the policy will **not** cover this event.
Copy file name to clipboardExpand all lines: docs/reference/elasticsearch/configuration-reference/circuit-breaker-settings.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,7 @@ The parent-level breaker can be configured with the following settings:
26
26
27
27
$$$indices-breaker-total-limit$$$
28
28
29
-
`indices.breaker.total.limit`
29
+
`indices.breaker.total.limit`
30
30
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Starting limit for overall parent breaker. Defaults to 70% of JVM heap if `indices.breaker.total.use_real_memory` is `false`. If `indices.breaker.total.use_real_memory` is `true`, defaults to 95% of the JVM heap.
31
31
32
32
@@ -36,12 +36,12 @@ The field data circuit breaker estimates the heap memory required to load a fiel
36
36
37
37
$$$fielddata-circuit-breaker-limit$$$
38
38
39
-
`indices.breaker.fielddata.limit`
39
+
`indices.breaker.fielddata.limit`
40
40
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Limit for fielddata breaker. Defaults to 40% of JVM heap.
41
41
42
42
$$$fielddata-circuit-breaker-overhead$$$
43
43
44
-
`indices.breaker.fielddata.overhead`
44
+
`indices.breaker.fielddata.overhead`
45
45
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A constant that all field data estimations are multiplied with to determine a final estimation. Defaults to `1.03`.
46
46
47
47
@@ -51,12 +51,12 @@ The request circuit breaker allows Elasticsearch to prevent per-request data str
51
51
52
52
$$$request-breaker-limit$$$
53
53
54
-
`indices.breaker.request.limit`
54
+
`indices.breaker.request.limit`
55
55
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Limit for request breaker, defaults to 60% of JVM heap.
56
56
57
57
$$$request-breaker-overhead$$$
58
58
59
-
`indices.breaker.request.overhead`
59
+
`indices.breaker.request.overhead`
60
60
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) A constant that all request estimations are multiplied with to determine a final estimation. Defaults to `1`.
61
61
62
62
@@ -89,7 +89,7 @@ Poorly written regular expressions can degrade cluster stability and performance
89
89
90
90
$$$script-painless-regex-enabled$$$
91
91
92
-
`script.painless.regex.enabled`
92
+
`script.painless.regex.enabled`
93
93
: ([Static](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#static-cluster-setting)) Enables regex in Painless scripts. Accepts:
Copy file name to clipboardExpand all lines: docs/reference/elasticsearch/configuration-reference/cluster-level-shard-allocation-routing-settings.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -165,20 +165,20 @@ You can use the following settings to control disk-based allocation:
165
165
166
166
$$$cluster-routing-disk-threshold$$$
167
167
168
-
`cluster.routing.allocation.disk.threshold_enabled`
168
+
`cluster.routing.allocation.disk.threshold_enabled`
169
169
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Defaults to `true`. Set to `false` to disable the disk allocation decider. Upon disabling, it will also remove any existing `index.blocks.read_only_allow_delete` index blocks.
170
170
171
171
$$$cluster-routing-watermark-low$$$
172
172
173
-
`cluster.routing.allocation.disk.watermark.low`
173
+
`cluster.routing.allocation.disk.watermark.low`
174
174
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the low watermark for disk usage. It defaults to `85%`, meaning that {{es}} will not allocate shards to nodes that have more than 85% disk used. It can alternatively be set to a ratio value, e.g., `0.85`. It can also be set to an absolute byte value (like `500mb`) to prevent {{es}} from allocating shards if less than the specified amount of space is available. This setting has no effect on the primary shards of newly-created indices but will prevent their replicas from being allocated.
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the max headroom for the low watermark (in case of a percentage/ratio value). Defaults to 200GB when `cluster.routing.allocation.disk.watermark.low` is not explicitly set. This caps the amount of free space required.
178
178
179
179
$$$cluster-routing-watermark-high$$$
180
180
181
-
`cluster.routing.allocation.disk.watermark.high`
181
+
`cluster.routing.allocation.disk.watermark.high`
182
182
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the high watermark. It defaults to `90%`, meaning that {{es}} will attempt to relocate shards away from a node whose disk usage is above 90%. It can alternatively be set to a ratio value, e.g., `0.9`. It can also be set to an absolute byte value (similarly to the low watermark) to relocate shards away from a node if it has less than the specified amount of free space. This setting affects the allocation of all shards, whether previously allocated or not.
`cluster.routing.allocation.disk.watermark.flood_stage`
192
+
`cluster.routing.allocation.disk.watermark.flood_stage`
193
193
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the flood stage watermark, which defaults to 95%. {{es}} enforces a read-only index block ([`index.blocks.read_only_allow_delete`](/reference/elasticsearch/index-settings/index-block.md)) on every index that has one or more shards allocated on the node, and that has at least one disk exceeding the flood stage. This setting is a last resort to prevent nodes from running out of disk space. The index block is automatically released when the disk utilization falls below the high watermark. Similarly to the low and high watermark values, it can alternatively be set to a ratio value, e.g., `0.95`, or an absolute byte value.
194
194
195
195
@@ -203,10 +203,10 @@ You can’t mix the usage of percentage/ratio values and byte values across the
203
203
204
204
$$$cluster-routing-flood-stage-frozen$$$
205
205
206
-
`cluster.routing.allocation.disk.watermark.flood_stage.frozen`
206
+
`cluster.routing.allocation.disk.watermark.flood_stage.frozen`
207
207
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the flood stage watermark for dedicated frozen nodes, which defaults to 95%.
208
208
209
-
`cluster.routing.allocation.disk.watermark.flood_stage.frozen.max_headroom`
209
+
`cluster.routing.allocation.disk.watermark.flood_stage.frozen.max_headroom`
210
210
: ([Dynamic](docs-content://deploy-manage/deploy/self-managed/configure-elasticsearch.md#dynamic-cluster-setting)) Controls the max headroom for the flood stage watermark (in case of a percentage/ratio value) for dedicated frozen nodes. Defaults to 20GB when `cluster.routing.allocation.disk.watermark.flood_stage.frozen` is not explicitly set. This caps the amount of free space required on dedicated frozen nodes.
0 commit comments