-
Type: Bug
-
Status: Resolved
-
Priority: Major
-
Resolution: Fixed
-
Affects Version/s: 10.10
-
Fix Version/s: None
-
Component/s: Audit, Elasticsearch
-
Tags:
-
Backlog priority:850
-
Sprint:nxplatform #50
When using a text field in the nuxeo-audit for the field docUUID, no events are shown in the history tab. You can get around this by overriding the DOCUMENT_HISTORY_PROVIDER page provider to use the following query
{ "bool" : { "must" : { "match" : { "docUUID" : { "query" : "?" } } } } }
Using the above will load the events in the audit tab but if principalName, eventId, eventCategory, etc are also text fields, trying to filter by any of these predicates returns no results.
It seems that it's expecting everything to be keyword fields instead of text fields even though these fields are not defined as keyword fields in the default elasticsearch-audit-mapping.json file.
The ES query appears as the following when trying to filter by principalName
{"must":[{"wrapper":{"query":"eyAiYm9vbCIgOiB7ICJtdXN0IiA6IHsgIm1hdGNoIiA6IHsgImRvY1VVSUQiIDogeyAicXVlcnkiIDogIjExYzY5YjUwLTQ4NzYtNGIyMC1iMjM4LTIxOGFiYmNiMzYyYSIgfSB9IH0gfSB9"}}],"filter":[{"bool":{"must":[{"terms":{"principalName":["Administrator"],"boost":1.0}}],"adjust_pure_negative":true,"boost":1.0}}],"adjust_pure_negative":true,"boost":1.0}},"sort":[{"eventDate":{"order":"desc"}}]}}'
- is related to
-
NXP-30666 Hardcode ES Audit fields
- Resolved