to get the service name we'd probably need to take HTTP_HOST value and find the corresponding entry in HTTP_X_SERVICE_CATALOG. (this is what we do in to generate CADF as well)
the full url path isn't part of CADF payload either -- it can be added (as its extensible) but it's not part of formal spec. i could get Matt to propose to add it to formal spec if you find value there (we've been adding/proposing a bunch of Openstack attr since we've started)
here is what the payload contains right now (the CADF_EVENT attr is there if and only if you use the middleware.audit, middleware.notifier does captures everything else):
to get the service name we'd probably need to take HTTP_HOST value and find the corresponding entry in HTTP_X_ SERVICE_ CATALOG. (this is what we do in to generate CADF as well)
the full url path isn't part of CADF payload either -- it can be added (as its extensible) but it's not part of formal spec. i could get Matt to propose to add it to formal spec if you find value there (we've been adding/proposing a bunch of Openstack attr since we've started)
here is what the payload contains right now (the CADF_EVENT attr is there if and only if you use the middleware.audit, middleware.notifier does captures everything else):
RESPONSE
{ "5213edc8eb2d73 3c8ed7d7cd" ), 31a6a8cb664a293 32f", signature" : "ef69c38520c068 91bf7a577d663ed 41a74a74f6fcc1c 3c998c5b558c263 1f1c3", "2013-08- 20T22:29: 28.482Z" ), metadata" : { plwdevstack" , X_TENANT_ NAME" : "service", e87bc03c42543ea babf/os- floating- ips", PROTOCOL" : "HTTP/1.0", 31a6a8cb664a293 32f", X_AUTH_ TOKEN" : "tokenid", USER_AGENT" : "python- novaclient" , X_DOMAIN_ NAME" : null, X_PROJECT_ DOMAIN_ ID" : null, ,admin, ResellerAdmin" , X_IDENTITY_ STATUS" : "Confirmed", X_DOMAIN_ ID" : null, schemas. dmtf.org/ cloud/audit/ 1.0/event", 20T22:28: 18.122305+ 0000", 10.0.2. 15:8774/ v2/2fb92e213965 4e87bc03c42543e ababf", 10.0.2. 15:8774/ v2/2fb92e213965 4e87bc03c42543e ababf", 10.0.2. 15:8774/ v2/2fb92e213965 4e87bc03c42543e ababf", b0b681551228474 203", on_id?value= f36fff90- 6b5e-54c2- 9438-73dc60c576 57" security/ account/ user", identity_ status" : "Confirmed" novaclient" , 87bc03c42543eab abf", 31a6a8cb664a293 32f" reporterTime" : "2013-08- 20T22:29: 28.480996+ 0000", 9afd-5911- 8644-0210448efa 5c" X_SERVICE_ CATALOG" : "[{\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:8774/ v2/2fb92e213965 4e87bc03c42543e ababf\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:8774/ v2/2fb92e213965 4e87bc03c42543e ababf\", \"internalURL\": \"http:// 10.0.2. 15:8774/ v2/2fb92e213965 4e87bc03c42543e ababf\", \"id\": \"2f134369e44b4 bb0b68155122847 4203\"} ], \"type\": \"compute\", \"name\": \"nova\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:8776/ v2/2fb92e213965 4e87bc03c42543e ababf\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:8776/ v2/2fb92e213965 4e87bc03c42543e ababf\", \"internalURL\": \"http:// 10.0.2. 15:8776/ v2/2fb92e213965 4e87bc03c42543e ababf\", \"id\": \"5b496aff75094 0d5b7c3f2f6129a 7e5c\"} ], \"type\": \"volumev2\", \"name\": \"cinder\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:8774/ v3\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:8774/ v3\", \"internalURL\": \"http:// 10.0.2. 15:8774/ v3\", \"id\": \"5d0dc523c3324 843b488296834bb 3267\"} ], \"type\": \"computev3\", \"name\": \"nova\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:3333\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:3333\", \"internalURL\": \"http:// 10.0.2. 15:3333\", \"id\": \"2bba8016bcf84 78f868896952af9 d633\"} ], \"type\": \"s3\", \"name\": \"s3\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:9292\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:9292\", \"internalURL\": \"http:// 10.0.2. 15:9292\", \"id\": \"09ff713feaa24 3a68867abcde784 bae3\"} ], \"type\": \"image\", \"name\": \"glance\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:8777\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:8777\", \"internalURL\": \"http:// 10.0.2. 15:8777\", \"id\": \"04d166257ec04 fbdaa70ce10cfcb b8c1\"} ], \"type\": \"metering\", \"name\": \"ceilometer\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:8776/ v1/2fb92e213965 4e87bc03c42543e ababf\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:8776/ v1/2fb92e213965 4e87bc03c42543e ababf\", \"internalURL\": \"http:// 10.0.2. 15:8776/ v1/2fb92e213965 4e87bc03c42543e ababf\", \"id\": \"831ff894a8db4 3db84ee4d1ed3e8 cbb5\"} ], \"type\": \"volume\", \"name\": \"cinder\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:8773/ services/ Admin\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:8773/ services/ Cloud\", \"internalURL\": \"http:// 10.0.2. 15:8773/ services/ Cloud\", \"id\": \"17977e7e2d504 918913bd916196e 78ce\"} ], \"type\": \"ec2\", \"name\": \"ec2\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:8080\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:8080/ v1/AUTH_ 2fb92e2139654e8 7bc03c42543eaba bf\", \"internalURL\": \"http:// 10.0.2. 15:8080/ v1/AUTH_ 2fb92e2139654e8 7bc03c42543eaba bf\", \"id\": \"7457330d4cfa4 f6587b93b05ec7f 6d6b\"} ], \"type\": \"object-store\", \"name\": \"swift\"}, {\"endpoints_ links\" : [], \"endpoints\": [{\"adminURL\": \"http:// 10.0.2. 15:35357/ v2.0\", \"region\": \"RegionOne\", \"publicURL\": \"http:// 10.0.2. 15:5000/ v2.0\", \"internalURL\": \"http:// 10.0.2. 15:5000/ v2.0\", \"id\": \"10bc3cf35d8f4 69db40420ccb3d3 aa14\"} ], \"type\": \"identity\", \"name\": \"keystone\"}]", X_TENANT_ ID" : "2fb92e2139654e 87bc03c42543eab abf", X_PROJECT_ DOMAIN_ NAME" : null, X_USER_ DOMAIN_ NAME" : null, X_USER_ DOMAIN_ ID" : null, X_AUTH_ PROJECT_ ID" : "service", 654e87bc03c4254 3eababf/ os-floating- ips", EVENT_CORRELATI ON_ID" : "f36fff90- 6b5e-54c2- 9438-73dc60c576 57", X_PROJECT_ NAME" : "service", X_PROJECT_ ID" : "2fb92e2139654e 87bc03c42543eab abf", X_USER_ NAME" : "ceilometer", INTERFACE" : "CGI/1.1", ,admin, ResellerAdmin" , ACCEPT_ ENCODING" : "gzip, deflate, compress" Length" : "20", compute- request- id" : "req-33891ab0- 60ce-408d- a721-9cd946ba40 cd" 87bc03c42543eab abf", 09e7-11e3- a181-080027317d 13",
"_id" : ObjectId(
"counter_name" : "http.response",
"user_id" : "36448cb2ec4546
"message_
"timestamp" : ISODate(
"resource_id" : null,
"resource_
"host" : "nova-api.
"request" : {
"HTTP_
"SCRIPT_NAME" : "/v2",
"REQUEST_METHOD" : "GET",
"PATH_INFO" : "/2fb92e2139654
"SERVER_
"HTTP_X_USER_ID" : "36448cb2ec4546
"HTTP_
"HTTP_
"HTTP_
"HTTP_
"REMOTE_PORT" : "48729",
"HTTP_X_ROLE" : "_member_
"HTTP_
"HTTP_
"SERVER_PORT" : "8774",
"CADF_EVENT" : {
"typeURI" : "http://
"eventTime" : "2013-08-
"target" : {
"typeURI" : "service/compute",
"addresses" : [
{
"url" : "http://
"name" : "admin"
},
{
"url" : "http://
"name" : "private"
},
{
"url" : "http://
"name" : "public"
}
],
"id" : "2f134369e44b4b
"name" : "nova"
},
"observer" : "target",
"tags" : [
"correlati
],
"eventType" : "activity",
"initiator" : {
"typeURI" : "service/
"name" : "ceilometer",
"credential" : {
"token" : "tokenid",
"
},
"host" : {
"agent" : "python-
"address" : "10.0.2.15"
},
"project_id" : "2fb92e2139654e
"id" : "36448cb2ec4546
},
"reason" : {
"reasonCode" : "200",
"reasonType" : "HTTP"
},
"reporterchain" : [
{
"
"role" : "modifier",
"reporter" : "target"
}
],
"action" : "list",
"outcome" : "success",
"id" : "c5e63215-
},
"HTTP_
"HTTP_
"HTTP_
"HTTP_
"HTTP_X_USER" : "ceilometer",
"HTTP_
"REMOTE_ADDR" : "10.0.2.15",
"HTTP_HOST" : "10.0.2.15:8774",
"HTTP_
"HTTP_X_TENANT" : "service",
"HTTP_ACCEPT" : "application/json",
"RAW_PATH_INFO" : "/v2/2fb92e2139
"SERVER_NAME" : "10.0.2.15",
"CADF_
"HTTP_
"HTTP_
"HTTP_
"CONTENT_TYPE" : "text/plain",
"GATEWAY_
"HTTP_X_ROLES" : "_member_
"HTTP_
},
"response" : {
"status" : "200 OK",
"headers" : {
"Content-
"Content-Type" : "application/json",
"x-
}
},
"event_type" : "http.response"
},
"source" : "openstack",
"counter_unit" : "response",
"counter_volume" : 1,
"project_id" : "2fb92e2139654e
"message_id" : "f9d7ae72-
"counter_type" : "delta"
}