Common sink parameters

These Boundary event sink parameters are shared across every sink type — file and stderr — and control what an event sink records and how:

• name - Specify a name for the sink.

• description - Specify a description for the sink.

• event_types - Specifies a list of event types that will be sent to the sink. Can be *, audit, error, observation, system, or telemetry.

• event_source_url - Specifies an optional event source URL for the sink. If not specified, the default source will be composed of the https://hashicorp.com/boundary.io/ServerName/Path/FileName.

• allow_filters - Specifies a set of predicates for including an event in the sink. If any filter matches, the event will be included. For more information, on using filters see: event filtering

• deny_filters - Specifies a set predicates for excluding an event in the sink. If any filter matches, the event will be excluded. For more information on using filters see: event filtering

• format - Specifies the format for the sink. Can be cloudevents-json, cloudevents-text, hclog-json, or hclog-text.

• type - Specifies the type of sink. Can be stderr or file.

• audit_config - Specifies configuration for the processing of audit events for the sink. This is ignored if the sink is not configured to receive audit events.

audit_config parameters

• audit_filter_overrides - Specifies overrides for the filter operations that are applied to audit events. The available filter override operations are:

  • "" (empty string): No filter operation is applied, and the field is logged in plaintext.
  • "encrypt": The field will be encrypted before being logged.
  • "hmac-sha256": The field will be hashed using HMAC-SHA256 before being logged.
  • "redact": The field will be redacted and not logged at all.

audit_filter_overrides parameters

• sensitive (string: "", "encrypt", "hmac-sha256", "redact") - Specifies the filter operation to apply to fields that are classified as sensitive. Sensitive fields are values containing identity revealing data like IP addresses and usernames.

• secret (string: "", "encrypt", "hmac-sha256", "redact") - Specifies the filter operation to apply to fields that are classified as secret. Secret fields are values such as credentials, passwords, tokens, and other information that could be exploited if exposed.

audit_config examples

This example is equivalent to the default settings if no audit_config stanza is provided.

audit_config {
  audit_filter_overrides {
    sensitive = "redact"
    secret    = "redact"
  }
}

This example will HMAC sensitive fields, and encrypt secrets.

audit_config {
  audit_filter_overrides {
    sensitive = "hmac-sha256"
    secret    = "encrypt"
  }
}

This example will not apply a filter to sensitive fields.

audit_config {
  audit_filter_overrides {
    sensitive = ""
  }
}