Drop Audit-Message such as Local deployment data read

Author: Chris Wiechmann

logstash/pipelines/DomainAuditPipeline.conf

@@ -10,7 +10,7 @@ filter {
     add_field => { "[processInfo][gatewayRegion]" => "%{[gatewayRegion]}" }
   }
 
-  if([message] =~ "Deployment data read by user " or [message] =~ "Deployment data with pending read by user ") {
+  if([message] =~ "Deployment data read by user " or [message] =~ "Deployment data with pending read by user " or [message] =~ "Local deployment data read by user ") {
     drop { }
   }
 }

logstash/test/domainAudit/test-domain-audit-events.json

@@ -18,6 +18,13 @@
         "{\"message\":\"Deployment data with pending read by user 'admin'\",\"eventId\":1041,\"user\":\"admin\",\"outcome\":\"success\",\"additionalInfo\":\"\",\"metaData\":{},\"timeStamp\":1606742273624}"
       ],
       "expected": [ ]
+    },
+    {
+      "description": "Also message 'Local deployment data read by user ...' should be dropped - As it is constantly created and doesn't bring any value.",
+      "input": [
+        "{\"message\":\"Local deployment data read by user 'admin'\",\"eventId\":1042,\"user\":\"admin\",\"outcome\":\"success\",\"additionalInfo\":\"\",\"metaData\":{},\"timeStamp\":1611165639863}"
+      ],
+      "expected": [ ]
     }
   ]
 }