# INDEX\_EVENT flooding audit logs

**URL:** <https://forum.opensearch.org/t/index-event-flooding-audit-logs/10674>\
**Category:** Security\
**Created:** [August 19, 2022, 10:41am UTC](https://forum.opensearch.org/t/index-event-flooding-audit-logs/10674 "2022-08-19T10:41:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jong](https://avatars.discourse-cdn.com/v4/letter/j/82dd89/32.png) [@jong](https://forum.opensearch.org/u/jong)\
**Post date:** [August 19, 2022, 10:41am UTC](https://forum.opensearch.org/t/index-event-flooding-audit-logs/10674/1 "2022-08-19T10:41:53Z")

</div>

Just switched over to OpenSearch 1.3.4 from Elasticsearch and we’re getting a lot of INDEX\_EVENT entries in our audit logs. They are rapidly filling up our disk as it contains every index name in it and we are getting thousands of these per hour.

Just wondering what this means, and wondering how we can disable?

```auto
{
    "audit_trace_task_parent_id": "n83eN-39Q_uiA10rV_Ct6w:269975",
    "audit_cluster_name": "opensearch",
    "audit_transport_headers": {
      "_opendistro_security_remote_address_header": /random string/,
      "_opendistro_security_initial_action_class_header": "GetAliasesRequest",
      "_opendistro_security_origin_header": "REST",
      "_opendistro_security_user_header": /random string/,
      "_opendistro_security_remotecn": "opensearch"
    },
    "audit_node_name": "node5",
    "audit_trace_task_id": "3CxQH-mXTYSY0isyQBocRQ:1345439",
    "audit_transport_request_type": "GetAliasesRequest",
    "audit_category": "INDEX_EVENT",
    "audit_request_origin": "REST",
    "audit_node_id": "3CxQH-mXTYSY0isyQBocRQ",
    "audit_request_layer": "TRANSPORT",
    "@timestamp": "2022-08-19T10:25:49.591+00:00",
    "audit_format_version": 4,
    "audit_request_remote_address": "aa.bb.cc.dd",
    "audit_request_privilege": "indices:admin/aliases/get",
    "audit_node_host_address": "aa.bb.cc.dd",
    "audit_request_effective_user": "admin",
    "audit_trace_resolved_indices": [
	/* HUGE LIST OF EVERY INDEX */
    ],
    "audit_node_host_name": "node5.xx.xx.xx"
  }

```

I tried setting  
`plugins.security.audit.config.disabled_rest_categories: INDEX_EVENT` but this resulted in an error:

`org.opensearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown setting [plugins.security.audit.config.disabled_rest_categories] did you mean [plugins.security.audit.config.enable_ssl_client_auth]?`

So I tried setting:  
`opendistro_security.audit.config.disabled_transport_categories: INDEX_EVENT`  
`opendistro_security.audit.config.disabled_rest_categories: INDEX_EVENT`  
which did not result in an error, but neither of these worked.

What are these events, and any ideas on how I can suppress these? The documentation at [Audit logs - OpenSearch documentation](https://opensearch.org/docs/latest/security-plugin/audit-logs/index/) makes no mention of INDEX\_EVENT types.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [August 19, 2022, 11:03am UTC](https://forum.opensearch.org/t/index-event-flooding-audit-logs/10674/2 "2022-08-19T11:03:17Z")

</div>

@jong Could you share your opensearch.yml file?

---

<div class="post-metadata">

**Author:** ![jong](https://avatars.discourse-cdn.com/v4/letter/j/82dd89/32.png) [@jong](https://forum.opensearch.org/u/jong)\
**Post date:** [August 19, 2022, 11:12am UTC](https://forum.opensearch.org/t/index-event-flooding-audit-logs/10674/3 "2022-08-19T11:12:47Z")

</div>

I think I’ve managed to disable it through the UI at /app/security-dashboards-plugin#/auditLogging  
I wasn’t aware it was configurable in there.

Looks to me like something isn’t quite right with the documentation and the example configs here.

Suggests it should be a string:

> <https://github.com/opensearch-project/security/blob/1.3/src/test/java/org/opensearch/security/auditlog/impl/DisabledCategoriesTest.java#L91>

Suggests it should be an array:

> <https://github.com/opensearch-project/security/blob/main/config/opensearch.yml.example#L74>

And those options are not actually accepted by OpenSearch anyway as above. At least in 1.3.4.