Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Embeddables] Excessive index-pattern SO access when loading a dashboard #90996

Closed
Dosant opened this issue Feb 10, 2021 · 7 comments
Closed

[Embeddables] Excessive index-pattern SO access when loading a dashboard #90996

Dosant opened this issue Feb 10, 2021 · 7 comments
Labels
enhancement New value added to drive a business result Feature:Dashboard Dashboard related features Feature:Data Views Data Views code and UI - index patterns before 8.0 impact:needs-assessment Product and/or Engineering needs to evaluate the impact of the change. loe:small Small Level of Effort performance

Comments

@Dosant
Copy link
Contributor

Dosant commented Feb 10, 2021

Kibana Version: master

Description:
While working on search sessions we were looking into audit logs to see how often we fetch/update search-session SO.

In a meantime, we noticed that when loading a sample dashboard the same index pattern is being fetched from es 64 times!

{"@timestamp":"2021-02-10T16:28:40.977+01:00","message":"User has accessed dashboard [id=edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"dashboard","id":"edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"bdec69a5-fdbb-4fd6-834a-c584819d1567"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=e1d0f010-9ee7-11e7-8711-e7a007dcef99]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"e1d0f010-9ee7-11e7-8711-e7a007dcef99"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=935afa20-e0cd-11e7-9d07-1398ccfcefa3]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"935afa20-e0cd-11e7-9d07-1398ccfcefa3"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=4eb6e500-e1c7-11e7-b6d5-4dc382ef7f5b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"4eb6e500-e1c7-11e7-b6d5-4dc382ef7f5b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=69a34b00-9ee8-11e7-8711-e7a007dcef99]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"69a34b00-9ee8-11e7-8711-e7a007dcef99"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.219+01:00","message":"User has accessed visualization [id=42b997f0-0c26-11e8-b0ec-3bb475f6b6ff]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"42b997f0-0c26-11e8-b0ec-3bb475f6b6ff"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=7cbd2350-2223-11e8-b802-5bcf64c2cfb4]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"7cbd2350-2223-11e8-b802-5bcf64c2cfb4"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=314c6f60-2224-11e8-b802-5bcf64c2cfb4]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"314c6f60-2224-11e8-b802-5bcf64c2cfb4"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=24a3e970-4257-11e8-b3aa-73fdaf54bfc9]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"24a3e970-4257-11e8-b3aa-73fdaf54bfc9"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=14e2e710-4258-11e8-b3aa-73fdaf54bfc9]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"14e2e710-4258-11e8-b3aa-73fdaf54bfc9"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed visualization [id=47f2c680-a6e3-11e8-94b4-c30c0228351b]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"visualization","id":"47f2c680-a6e3-11e8-94b4-c30c0228351b"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.220+01:00","message":"User has accessed index-pattern [id=d3d7af60-4c81-11e8-b3d7-01146121b73d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"d3d7af60-4c81-11e8-b3d7-01146121b73d"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"178b193c-1fb6-4cf9-be97-74c88e07ef3b"}}
{"@timestamp":"2021-02-10T16:28:41.243+01:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d907a5fd-c5ad-4484-8cc6-fe900e53ee3b"}}
{"@timestamp":"2021-02-10T16:28:41.276+01:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"space_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d907a5fd-c5ad-4484-8cc6-fe900e53ee3b"}}
{"@timestamp":"2021-02-10T16:28:41.482+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"a7f6f31a-b9bc-4768-a2d8-fbee96d1487e"}}
{"@timestamp":"2021-02-10T16:28:41.511+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"3a4c0fbf-ca02-4a92-99dc-2a4e48fec6e2"}}
{"@timestamp":"2021-02-10T16:28:41.513+01:00","message":"User has accessed map [id=de71f4f0-1902-11e9-919b-ffe5949a18d2]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"map","id":"de71f4f0-1902-11e9-919b-ffe5949a18d2"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"755fc2e0-b692-4218-a585-8483df6bbf74"}}
{"@timestamp":"2021-02-10T16:28:41.513+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"755fc2e0-b692-4218-a585-8483df6bbf74"}}
{"@timestamp":"2021-02-10T16:28:41.562+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"e333c73b-4151-4506-81b5-3d059b77fce3"}}
{"@timestamp":"2021-02-10T16:28:41.583+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"d6f36c0e-a280-4a35-8a13-bda819880313"}}
{"@timestamp":"2021-02-10T16:28:42.028+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.044+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.162+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.186+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.391+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.468+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.470+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.486+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.493+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.494+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.526+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.609+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.612+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.621+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.627+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.629+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.633+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.686+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.690+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.704+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.707+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.714+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.717+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.749+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.794+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.803+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.809+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.814+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.820+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.867+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:42.876+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.880+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.886+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.887+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.893+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.893+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.895+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:42.906+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.962+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"8a365653-275c-470d-b7f8-c46704ed22f5"}}
{"@timestamp":"2021-02-10T16:28:42.973+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.975+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.994+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.996+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:42.998+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.042+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.043+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.066+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.067+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.070+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:43.071+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.072+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.074+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.084+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_find","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"7edfd2bc-9b85-48a6-ad9b-8fad51fe4d38"}}
{"@timestamp":"2021-02-10T16:28:43.104+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.107+01:00","message":"User is creating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_create","category":"database","type":"creation","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:43.108+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.123+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.127+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.129+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.131+01:00","message":"User has accessed index-pattern [id=90943e30-9a47-11e8-b64d-95841ca0b247]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_get","category":"database","type":"access","outcome":"success"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"index-pattern","id":"90943e30-9a47-11e8-b64d-95841ca0b247"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"cb3f9bc4-301b-4fa5-a48f-bce58e6c991b"}}
{"@timestamp":"2021-02-10T16:28:43.699+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"6c73b328-ed0e-4315-9ede-68b1f2a3045c"}}
{"@timestamp":"2021-02-10T16:28:45.061+01:00","message":"User is updating search-session [id=6ea04c6e-d098-4443-8e23-424d884944c8]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95624},"ecs":{"version":"1.6.0"},"event":{"action":"saved_object_update","category":"database","type":"change","outcome":"unknown"},"kibana":{"space_id":"default","session_id":"eeFxB/Yg5S33Had/vZ4k27Ogk4AUcCSOpO828gl+qiY=","saved_object":{"type":"search-session","id":"6ea04c6e-d098-4443-8e23-424d884944c8"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"41eecc02-a366-4d9c-98dd-063fc90a2530"}}

In this case, I have opened [Logs] Web Traffic
and my logging configuration:

xpack.security.audit:
  enabled: true
  appender:
    kind: console
    layout:
      kind: json
  ignore_filters:
    - actions: [http_request]

I am not sure what is causing such excessive fetching, especially as we recently significantly improved index-pattern fetching: #82153 #82603 . In the browser, there is seem like 5-10 fetches of the same index pattern from different visualizations, but I not even close to 64 that audit logs report.

This issue is very likely causing redundant load on kibana server and es with each dashboard load which we probably can reduce it.

I not sure if there is a similar situation in an older versions
@Dosant Dosant added Feature:Dashboard Dashboard related features enhancement New value added to drive a business result Feature:Data Views Data Views code and UI - index patterns before 8.0 Team:AppServices labels Feb 10, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-app-services (Team:AppServices)

@mattkime
Copy link
Contributor

@Dosant I took a look at the /api/saved_objects/_bulk_get requests and I can confirm that the index pattern is loaded multiple times however all except for one is loaded as a part of a references array defined off another requested saved object.

Perhaps someone from @elastic/kibana-core might have some insight into this behavior.

@Dosant Dosant mentioned this issue Feb 11, 2021
Merged
2 tasks
@mattkime
Copy link
Contributor

I spoke to core about this and they say that this has to do with how individual embeddables are loading data.

@legrego
Copy link
Member

legrego commented Feb 12, 2021

@mattkime is there something we can do for embeddables to optimize this behavior? I ask as someone who has never used/produced an embeddable, so I'm not aware of the challenges/tradeoffs.

@pgayvallet
Copy link
Contributor

is there something we can do for embeddables to optimize this behavior? I ask as someone who has never used/produced an embeddable

Same situation here, but yea, I would expect that some kind of throttle/debounce cache in front of the pattern fetching logic could help a lot here. FWIW, it's what we did on core's savedObjects service

kibana/src/core/public/saved_objects/saved_objects_client.ts

Lines 373 to 382 in 4584a8b

public get = <T = unknown>(type: string, id: string): Promise<SimpleSavedObject<T>> => {
if (!type || !id) {
return Promise.reject(new Error('requires type and id'));
}
return new Promise((resolve, reject) => {
this.batchQueue.push({ type, id, resolve, reject } as BatchQueueEntry);
this.processBatchQueue();
});
};

@exalate-issue-sync exalate-issue-sync bot added impact:needs-assessment Product and/or Engineering needs to evaluate the impact of the change. loe:small Small Level of Effort labels Dec 13, 2021
@mattkime
Copy link
Contributor

I spoke to my team about this and it sounds like this needs to be examined at the embeddable level.

@exalate-issue-sync exalate-issue-sync bot changed the title [Index Patterns] Excessive index-pattern SO access when loading a dashboard [Embeddables] Excessive index-pattern SO access when loading a dashboard Jan 11, 2022
@exalate-issue-sync exalate-issue-sync bot mentioned this issue Aug 24, 2022
Closed
@dokmic
Copy link
Contributor

dokmic commented Aug 24, 2022

This issue is no longer valid. Currently, a number of fetching of the data view matches the XHR number. And for this same dashboard, it is 9 in total (7 find and 2 resolve) requests. Unfortunately, I wasn't able to trace what exact change fixed that because it might be some optimization in a single visualization type.

Additionally, I checked what could be done on the embeddables plugin side and found nothing. The plugin indeed depends on the saved object plugin, but it only reexports the SavedObjectsFinder. There is no logic that could potentially cause such excessive loading nor anything that can be optimized.

@dokmic dokmic closed this as completed Aug 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New value added to drive a business result Feature:Dashboard Dashboard related features Feature:Data Views Data Views code and UI - index patterns before 8.0 impact:needs-assessment Product and/or Engineering needs to evaluate the impact of the change. loe:small Small Level of Effort performance
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@mattkime @pgayvallet @legrego @Dosant @dokmic @elasticmachine