diff --git a/ydb/core/audit/audit_log_impl.cpp b/ydb/core/audit/audit_log_impl.cpp index e03e9ac7ff8e..0a2ed1b96944 100644 --- a/ydb/core/audit/audit_log_impl.cpp +++ b/ydb/core/audit/audit_log_impl.cpp @@ -91,6 +91,25 @@ TString GetJsonLog(const TEvAuditLog::TEvWriteAuditLog::TPtr& ev) { return ss.Str(); } +TString GetJsonLogCompatibleLog(const TEvAuditLog::TEvWriteAuditLog::TPtr& ev) { + const auto* msg = ev->Get(); + NJsonWriter::TBuf json; + { + auto obj = json.BeginObject(); + obj + .WriteKey("@timestamp") + .WriteString(msg->Time.ToString().data()) + .WriteKey("@log_type") + .WriteString("audit"); + + for (auto& [k, v] : msg->Parts) { + obj.WriteKey(k).WriteString(v); + } + json.EndObject(); + } + return json.Str(); +} + TString GetTxtLog(const TEvAuditLog::TEvWriteAuditLog::TPtr& ev) { const auto* msg = ev->Get(); TStringStream ss; @@ -146,6 +165,9 @@ class TAuditLogActor final : public TActor { case NKikimrConfig::TAuditConfig::TXT: WriteLog(GetTxtLog(ev), logBackends.second); break; + case NKikimrConfig::TAuditConfig::JSON_LOG_COMPATIBLE: + WriteLog(GetJsonLogCompatibleLog(ev), logBackends.second); + break; default: WriteLog(GetJsonLog(ev), logBackends.second); break; diff --git a/ydb/core/protos/config.proto b/ydb/core/protos/config.proto index b98e0f6671c5..d5ae1c444051 100644 --- a/ydb/core/protos/config.proto +++ b/ydb/core/protos/config.proto @@ -1438,8 +1438,9 @@ message TMeteringConfig { message TAuditConfig { enum EFormat { - JSON = 1; - TXT = 2; + JSON = 1; // Outputs audit log in format: "