audit_json.log serializes ip_address into JSON object
audit_json.log appears to be serializing ip_address as an object with family, addr, and mask_addr instead of just a simple string, which is causing Elasticsearch to reject these entries:
{
"severity":"INFO",
"time":"2020-07-23T13:34:09.205Z",
"correlation_id":"34IGPTSPB7",
"id":null,
"author_id":1954985,
"entity_id":18869427,
"entity_type":"Project",
"details":{
"author_name":"redacated",
"target_id":310428,
"target_type":"ApprovalProjectRule",
"target_details":"anyone master",
"custom_message":"Added User X to approval group on anyone master rule",
"ip_address":null,
"entity_path":"redacted"
},
"created_at":"2020-07-23T13:34:09.185Z",
"ip_address":{
"family":2,
"addr":1300105045,
"mask_addr":4294967295
},
"author_name":"redacted",
"entity_path":"redacted",
"target_details":null
}
@smcgivern @mwoolf I think this was partially fixed in !35356 (merged) (#224539 (closed)), but only in the presenter. If I look at the database entry, it seems we are storing an IPAddr object here? It seems to me we shouldn't do that?
[ gprd ] production> proj.audit_events.last
=> #<SecurityEvent id: 346169840, author_id: 1954985, type: "SecurityEvent", entity_id: 18869427, entity_type: "Project", details: {:author_name=>"Nadav", :target_id=>310429, :target_type=>"ApprovalProjectRule", :target_details=>"second eye", :custom_message=>"Added User X to approval group on second eye rule", :ip_address=>nil, :entity_path=>"redacted"}, created_at: "2020-07-23 13:34:09", ip_address: #<IPAddr: IPv4:77.126.7.85/255.255.255.255>, author_name: "edacted", entity_path: "redacted", target_details: nil>
Edited by Stan Hu