cloud audit trail docs - #8382
Open
shainaraskas wants to merge 6 commits into
Open
shainaraskas wants to merge 6 commits into
shainaraskas wants to merge 6 commits into
Conversation
Contributor
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
Contributor
Contributor
Elastic Docs Style Checker (Vale)Summary: 1 warning found
|
| File | Line | Rule | Message |
|---|---|---|---|
| deploy-manage/monitor/log-delivery/cloud-audit-trail.md | 99 | Elastic.Spelling | 'backfilled' is a possible misspelling. |
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.
shainaraskas
commented
Sep 18, 2026
| @@ -1,13 +1,13 @@ | |||
| --- | |||
| navigation_title: Audit trail | |||
| navigation_title: Serverless audit trail | |||
Member
Author
There was a problem hiding this comment.
need these contexts to be more distinct in search/sidebar in future
shainaraskas
marked this pull request as ready for review
September 18, 2026 19:11
consulthys
approved these changes
Sep 21, 2026
consulthys
self-requested a review
September 21, 2026 11:10
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Docs review summary
Criteria
- User focus: Strong. The page opens with the audit questions readers actually want answered, and the new cross-links (
monitor.md,logging-configuration.md,orchestrators.md,ecloud-security.md,fedramp.md,cluster-comparison.md) make the feature discoverable from the places readers would naturally look for it. - Technical accuracy: One issue found — see inline comment on
security-event-audit-logging.md:23, where the newly-included snippet ends in a link back to the same page. The API examples, requirements, and retention/failure-store claims read as internally consistent and weren't contradicted by anything else in the local repo or in published docs I could check. - Applicability: The page's
applies_to: deployment: ech: ga(lines 4–6) tags this as generally available on ECH, while both the page's own admonition andfedramp.md's new comparison row (line 51) state the feature is {{fedramp-mod}}-only ({{ech}}: No). This matches the existing convention elsewhere in this PR —fedramp.mditself is taggedess: gadespite being FedRAMP-specific content, since there's no separate FedRAMP applies_to key — so this isn't a new problem introduced by the diff, but it's worth a maintainer gut-check thatech: gais the intended tag for a FedRAMP-gated feature rather than an oversight. - Maintainability: Good. Reuses the
cluster-comparison.mdandecloud-security.mdsnippets rather than duplicating tables, and the in-source<!-- TODO -->comments about ECH-commercial expansion correspond to the "Future work" items already disclosed in the PR description (including tracked issue docs-content-internal#1859), so they're not scope creep. - Language: One unexpanded acronym flagged inline (
cloud-audit-trail.md:90, "ECS"). Otherwise reads in the established second-person, active-voice style. - Style: Vale reported an
Elastic.MappedPagesnote and amay→can, mightsuggestion inmonitor.md, and anElastic.Repetitionsuggestion inaudit-trail.md:58— all three fall on lines this diff doesn't touch, so they're excluded here as pre-existing. - Issue satisfaction: Not applicable — the linked issue (docs-content-internal#1097) is in a private repo I can't read, so I can't confirm the page satisfies its requirements.
Nits
deploy-manage/security/_snippets/cluster-comparison.md:29— missing a space before the pipe: "Configurable ({{fedramp-mod}} only)|" should read "only) |".deploy-manage/monitor.md's new bullet links "enable audit logging" to the concept page, whilecloud-audit-trail.md:54links the same "enable audit logging" phrasing to the how-to pageenabling-audit-logs.md. Worth pointing both at the how-to page for the same action-phrased text, though both targets are valid.
Notes
- Couldn't verify the linked issue
docs-content-internal#1097(private repo) for issue-satisfaction assessment. - The embedded
<!-- TODO -->comments incloud-audit-trail.md(around lines 37–42 and 46–52) match the PR's disclosed "Future work" section, so no action needed there.
Generated by Docs review agent for #8382 · claude · sonnet · 258.6 AIC · ⊞ 19K
wajihaparvez
approved these changes
Sep 21, 2026
| * A [Platinum or Enterprise subscription]({{subscriptions}}). | ||
| * An [{{ecloud}} API key](/deploy-manage/api-keys/elastic-cloud-api-keys.md) with organization owner permissions. | ||
| * A destination deployment in the same organization to store audit logs. You might choose to use a dedicated deployment to keep audit data separate from production workloads. | ||
| * Your organization ID. You can find this on the [**Organization**](https://cloud.elastic.co/organization/members) page under the organization name. |
Contributor
There was a problem hiding this comment.
Suggested change
| * Your organization ID. You can find this on the [**Organization**](https://cloud.elastic.co/organization/members) page under the organization name. | |
| * Your organization ID. You can find this on the [Organization](https://cloud.elastic.co/organization/members) page under the organization name. |
I find bold links distracting but up to you to take or leave
| * An ingest pipeline for the `elastic_cloud.audit` data stream | ||
| * Field mappings, including [ECS](https://www.elastic.co/docs/reference/ecs) fields and `elastic_cloud.audit.api_key.*` fields | ||
| * The **{{ecloud}} audit logs** data view (`logs-elastic_cloud.audit-*`) | ||
| * The **[{{ecloud}}] Audit Logs** dashboard |
Contributor
There was a problem hiding this comment.
is the square bracket here intentional/from the UI?
Contributor
There was a problem hiding this comment.
That's just the name of the dashboard, it's pretty usual to name them that way, but for the docs they don't need to be there, not a big deal
| 3. Replace `<DESTINATION_DEPLOYMENT_ID>` with the ID of the hosted deployment that receives the logs | ||
| 4. Represents the default data stream namespace. | ||
|
|
||
| To use a different data stream namespace, replace the `default` segment of the index name with your preferred namespace, for example `logs-elastic_cloud.audit-production`. The name must match the `logs-elastic_cloud.audit-*` pattern so that the installed index templates apply. |
Contributor
There was a problem hiding this comment.
I would indent this if it's all related to point 4
|
|
||
| To use a different data stream namespace, replace the `default` segment of the index name with your preferred namespace, for example `logs-elastic_cloud.audit-production`. The name must match the `logs-elastic_cloud.audit-*` pattern so that the installed index templates apply. | ||
|
|
||
| The data stream is created with a configurable retention policy that defaults to 30 days, and the failure store enabled. |
Contributor
There was a problem hiding this comment.
Suggested change
| The data stream is created with a configurable retention policy that defaults to 30 days, and the failure store enabled. | |
| The data stream has a configurable retention policy that defaults to 30 days, and the failure store is enabled. |
Sounded a little awk
Contributor
We'll need to change some technical terms, such as data stream names. Still figuring out the blast radius. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a page for the Elastic Cloud audit trail feature, scoped to FedRAMP Moderate only. Based on engineering docs from cp-hosted, rewritten for style and structure.
adds xrefs to make the feature discoverable: security, monitoring, cluster audit logging ...
fixes https://github.com/elastic/docs-content-internal/issues/1097
Preview
core page: click here!
Future work
AI disclosure
made with my pal opus 4.6