集群 IP 溯源

# req/rsp均支持独立开启、关闭
"http.tracer.request.enable"
"http.tracer.response.enable"
?
# 支持使用uri前缀过滤
"http.tracer.include"
"http.tracer.exclude"
?
# 支持ip过滤
"http.tracer.remote_ip.include"
"http.tracer.remote_ip.exclude"
?
# body打印支持独立开启、关闭
"http.tracer.request.body.enable"
"http.tracer.response.body.enable"

PUT _cluster/settings
{
  "transient": {
    "http.tracer.request.enable": false,
    "http.tracer.response.enable": false,
    "http.tracer.include": null,
    "http.tracer.exclude": null,
    "http.tracer.remote_ip.include": null,
    "http.tracer.remote_ip.exclude": null,
    "http.tracer.request.body.enable": false,
    "http.tracer.response.body.enable": false
  }
}
?
———关闭ip溯源日志———
不打印

PUT _cluster/settings
{
  "transient": {
    "http.tracer.request.enable": true,
    "http.tracer.response.enable": true,
    "http.tracer.include": [
      "/.kibana/_search"
    ]
  }
}
?
———日志，打印req，rsp———
[2023-04-17T15:39:26,952][INFO ][o.e.h.HttpTracer         ] [1681467780000360532] [29940][null][GET][/.kibana/_search] received request from [Netty4HttpChannel{localAddress=/9.10.64.164:9200, remoteAddress=/9.2.1.38:41696}]
[2023-04-17T15:39:26,959][INFO ][o.e.h.HttpTracer         ] [1681467780000360532] [29940][null][OK][application/json; charset=UTF-8][2600808] sent response to [Netty4HttpChannel{localAddress=/9.10.64.164:9200, remoteAddress=/9.2.1.38:41696}] success [true]
---公网访问情况---
[2023-04-25T11:36:13,197][INFO ][o.e.h.HttpTracer         ] [1681703897000800432] [74][null][GET][/.kibana/_search] received request from [Netty4HttpChannel{localAddress=/9.10.66.6:9200, remoteAddress=/9.10.65.111:53349}], body [], x-forwarded-for [113.108.77.60]
[2023-04-25T11:36:13,238][INFO ][o.e.h.HttpTracer         ] [1681703897000800432] [74][null][OK][application/json; charset=UTF-8][2607129] sent response to [Netty4HttpChannel{localAddress=/9.10.66.6:9200, remoteAddress=/9.10.65.111:53349}] success [true]

PUT _cluster/settings
{
  "transient": {
    "http.tracer.request.enable": true,
    "http.tracer.response.enable": false,
    "http.tracer.request.body.enable": true,
    "http.tracer.include": [
      "/.kibana/_search"
    ]
  }
}
?
———日志，打印body，不打印rsp———
[2023-04-25T10:36:08,090][INFO ][o.e.h.HttpTracer         ] [1681703897000800432] [148][null][GET][/.kibana/_search] received request from [Netty4HttpChannel{localAddress=/9.10.66.6:9200, remoteAddress=/9.2.1.38:53310}], body [{"query":{"query_string":{"query":"*"}}}]

PUT _cluster/settings
{
  "transient": {
    "http.tracer.request.enable": true,
    "http.tracer.response.enable": false,
    "http.tracer.request.body.enable": true,
    "http.tracer.remote_ip.exclude": "9.2.1.38",
    "http.tracer.include": [
      "/.kibana/_search"
    ]
  }
}
?
———日志，过滤指定ip———
不打印