MySQL Enterprise fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
MySQL Enterprise Audit module
Fields from MySQL Enterprise Logs
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Beta
Beta
Module for parsing MySQL Enterprise Audit Logs
mysqlenterprise.audit.class-
A string representing the event class. The class defines the type of event, when taken together with the event item that specifies the event subclass.
type: keyword
mysqlenterprise.audit.connection_id-
An integer representing the client connection identifier. This is the same as the value returned by the CONNECTION_ID() function within the session.
type: keyword
mysqlenterprise.audit.id-
An unsigned integer representing an event ID.
type: keyword
mysqlenterprise.audit.connection_data.connection_type-
The security state of the connection to the server. Permitted values are tcp/ip (TCP/IP connection established without encryption), ssl (TCP/IP connection established with encryption), socket (Unix socket file connection), named_pipe (Windows named pipe connection), and shared_memory (Windows shared memory connection).
type: keyword
mysqlenterprise.audit.connection_data.status-
An integer representing the command status: 0 for success, nonzero if an error occurred.
type: long
mysqlenterprise.audit.connection_data.db-
A string representing a database name. For connection_data, it is the default database. For table_access_data, it is the table database.
type: keyword
mysqlenterprise.audit.connection_data.connection_attributes-
Connection attributes that might be passed by different MySQL Clients.
type: flattened
mysqlenterprise.audit.general_data.command-
A string representing the type of instruction that generated the audit event, such as a command that the server received from a client.
type: keyword
mysqlenterprise.audit.general_data.sql_command-
A string that indicates the SQL statement type.
type: keyword
mysqlenterprise.audit.general_data.query-
A string representing the text of an SQL statement. The value can be empty. Long values may be truncated. The string, like the audit log file itself, is written using UTF-8 (up to 4 bytes per character), so the value may be the result of conversion.
type: keyword
mysqlenterprise.audit.general_data.status-
An integer representing the command status: 0 for success, nonzero if an error occurred. This is the same as the value of the mysql_errno() C API function.
type: long
mysqlenterprise.audit.login.user-
A string representing the information indicating how a client connected to the server.
type: keyword
mysqlenterprise.audit.login.proxy-
A string representing the proxy user. The value is empty if user proxying is not in effect.
type: keyword
mysqlenterprise.audit.shutdown_data.server_id-
An integer representing the server ID. This is the same as the value of the server_id system variable.
type: keyword
mysqlenterprise.audit.startup_data.server_id-
An integer representing the server ID. This is the same as the value of the server_id system variable.
type: keyword
mysqlenterprise.audit.startup_data.mysql_version-
An integer representing the server ID. This is the same as the value of the server_id system variable.
type: keyword
mysqlenterprise.audit.table_access_data.db-
A string representing a database name. For connection_data, it is the default database. For table_access_data, it is the table database.
type: keyword
mysqlenterprise.audit.table_access_data.table-
A string representing a table name.
type: keyword
mysqlenterprise.audit.table_access_data.query-
A string representing the text of an SQL statement. The value can be empty. Long values may be truncated. The string, like the audit log file itself, is written using UTF-8 (up to 4 bytes per character), so the value may be the result of conversion.
type: keyword
mysqlenterprise.audit.table_access_data.sql_command-
A string that indicates the SQL statement type.
type: keyword
mysqlenterprise.audit.account.user-
A string representing the user that the server authenticated the client as. This is the user name that the server uses for privilege checking.
type: keyword
mysqlenterprise.audit.account.host-
A string representing the client host name.
type: keyword
mysqlenterprise.audit.login.os-
A string representing the external user name used during the authentication process, as set by the plugin used to authenticate the client.
type: keyword