Use Elasticsearch to store NetApp StorageGRID audit log and build search index for objects

Save
2 years ago
59
storagegrid netapp object s3 search audit log tags

Prior to StorageGRID 11.6, StorageGRID couldn't forward audit log to external syslog servers. You had to copy it off the primary admin node, convert to JSON and upload.
https://github.com/scaleoutsean/storagegrid-audit-analysis

Version 11.6 has audit log forwarding.

This demo shows StorageGRID 11.7 and Elasticsearch 8.7.1:
a) Audit log forwarding: forwards audit log to Logstash which processes it and forwards to Elasticsearch
See https://docs.netapp.com/us-en/storagegrid-enable/tools-apps-guides/elk-instructions.html for more.
b) Platform services (search): configure StorageGRID to send event updates to Elasticsearch API endpoint. These updates are JSON files with system and object metadata, and allow us to search for various properties in Elasticsearch.
See https://docs.netapp.com/us-en/storagegrid-117/tenant/using-search-integration-service.html

Loading comments...