Package org.forgerock.audit.handlers.elasticsearch

Class ElasticsearchAuditEventHandler

java.lang.Object

org.forgerock.audit.events.handlers.AuditEventHandlerBase

org.forgerock.audit.handlers.elasticsearch.ElasticsearchAuditEventHandler

All Implemented Interfaces:

AuditEventHandler, BatchConsumer

public class ElasticsearchAuditEventHandler
extends AuditEventHandlerBase
implements BatchConsumer

AuditEventHandler for Elasticsearch.

Field Summary

Fields inherited from class org.forgerock.audit.events.handlers.AuditEventHandlerBase

eventTopicsMetaData

Constructor Summary

Constructors

Constructor	Description
ElasticsearchAuditEventHandler(ElasticsearchAuditEventHandlerConfiguration configuration, EventTopicsMetaData eventTopicsMetaData, org.forgerock.http.Client client)	Create a new ElasticsearchAuditEventHandler instance.

Method Summary

Modifier and Type	Method	Description
void	addToBatch(String topic, org.forgerock.json.JsonValue event, StringBuilder payload)	Adds an audit event to an Elasticsearch Bulk API payload.
protected String	buildBaseUri()	Builds an Elasticsearch API base URI.
protected String	buildBasicAuthHeaderValue()	Builds a basic authentication header-value, if username and password are provided in configuration.
protected String	buildBulkUri()	Builds an Elasticsearch API URI for Bulk API.
protected String	buildEventUri(String topic, String eventId)	Builds an Elasticsearch API URI for operating on a single event (e.g., index, get, etc.).
protected String	buildSearchUri(String topic, int pageSize, int offset)	Builds an Elasticsearch API URI for Search API.
org.forgerock.util.promise.Promise<Void,BatchException>	publishBatch(String payload)	Publishes a Bulk API payload to Elasticsearch.
org.forgerock.util.promise.Promise<ResourceResponse,ResourceException>	publishEvent(org.forgerock.services.context.Context context, String topic, org.forgerock.json.JsonValue event)
protected org.forgerock.util.promise.Promise<ResourceResponse,ResourceException>	publishSingleEvent(String topic, org.forgerock.json.JsonValue event)	Publishes a single event to the provided topic.
org.forgerock.util.promise.Promise<QueryResponse,ResourceException>	queryEvents(org.forgerock.services.context.Context context, String topic, QueryRequest query, QueryResourceHandler handler)	Queries the Elasticsearch Search API for audit events.
org.forgerock.util.promise.Promise<ResourceResponse,ResourceException>	readEvent(org.forgerock.services.context.Context context, String topic, String resourceId)
protected static ResourceException	resourceException(String indexName, String topic, String resourceId, org.forgerock.http.protocol.Response response)	Gets an Exception Promise containing an Elasticsearch HTTP response status and payload.
void	shutdown()
void	startup()

Methods inherited from class org.forgerock.audit.events.handlers.AuditEventHandlerBase

getHandledTopics, getName, handleAction, isEnabled

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ElasticsearchAuditEventHandler

public ElasticsearchAuditEventHandler(ElasticsearchAuditEventHandlerConfiguration configuration,
 EventTopicsMetaData eventTopicsMetaData,
 org.forgerock.http.Client client)

Create a new ElasticsearchAuditEventHandler instance.

Parameters:

configuration - Configuration parameters that can be adjusted by system administrators.

eventTopicsMetaData - Meta-data for all audit event topics.

client - HTTP client or null to use default client.

Method Details

startup

public void startup()
             throws ResourceException

Specified by:

startup in interface AuditEventHandler

Throws:

ResourceException

shutdown

public void shutdown()
              throws ResourceException

Specified by:

shutdown in interface AuditEventHandler

Throws:

ResourceException

queryEvents

public org.forgerock.util.promise.Promise<QueryResponse,ResourceException> queryEvents(org.forgerock.services.context.Context context,
 String topic,
 QueryRequest query,
 QueryResourceHandler handler)

Queries the Elasticsearch Search API for audit events.

Specified by:

queryEvents in interface AuditEventHandler

readEvent

public org.forgerock.util.promise.Promise<ResourceResponse,ResourceException> readEvent(org.forgerock.services.context.Context context,
 String topic,
 String resourceId)

Specified by:

readEvent in interface AuditEventHandler

publishEvent

public org.forgerock.util.promise.Promise<ResourceResponse,ResourceException> publishEvent(org.forgerock.services.context.Context context,
 String topic,
 org.forgerock.json.JsonValue event)

Specified by:

publishEvent in interface AuditEventHandler

publishSingleEvent

protected org.forgerock.util.promise.Promise<ResourceResponse,ResourceException> publishSingleEvent(String topic,
 org.forgerock.json.JsonValue event)

Publishes a single event to the provided topic.

Parameters:

topic - The topic where to publish the event.

event - The event to publish.

Returns:

a promise with either a response or an exception

addToBatch

public void addToBatch(String topic,
 org.forgerock.json.JsonValue event,
 StringBuilder payload)
                throws BatchException

Adds an audit event to an Elasticsearch Bulk API payload.

Specified by:

addToBatch in interface BatchConsumer

Parameters:

topic - Event topic

event - Event JSON payload

payload - Elasticsearch Bulk API payload

Throws:

BatchException - indicates failure to add-to-batch

publishBatch

public org.forgerock.util.promise.Promise<Void,BatchException> publishBatch(String payload)

Publishes a Bulk API payload to Elasticsearch.

Specified by:

publishBatch in interface BatchConsumer

Parameters:

payload - Elasticsearch Bulk API payload

buildBasicAuthHeaderValue

protected String buildBasicAuthHeaderValue()

Builds a basic authentication header-value, if username and password are provided in configuration.

Returns:

Basic authentication header-value or null if not configured

buildEventUri

protected String buildEventUri(String topic,
 String eventId)

Builds an Elasticsearch API URI for operating on a single event (e.g., index, get, etc.).

Parameters:

topic - Audit topic

eventId - Event ID

Returns:

URI

buildBulkUri

protected String buildBulkUri()

Builds an Elasticsearch API URI for Bulk API.

Returns:

URI

buildSearchUri

protected String buildSearchUri(String topic,
 int pageSize,
 int offset)

Builds an Elasticsearch API URI for Search API.

Parameters:

topic - The audit topic to search.

pageSize - The number of results to return.

offset - The number of results to skip.

Returns:

The search uri.

buildBaseUri

protected String buildBaseUri()

Builds an Elasticsearch API base URI. The format is,

http[s]://host:port/indexName

Returns:

Base URI

resourceException

protected static ResourceException resourceException(String indexName,
 String topic,
 String resourceId,
 org.forgerock.http.protocol.Response response)

Gets an Exception Promise containing an Elasticsearch HTTP response status and payload.

Parameters:

indexName - Index name

topic - Event topic

resourceId - Event ID

response - HTTP response

Returns:

Exception Promise