<p dir="auto">hi, guys,   i wrote a Filter whice extends ActionFilter.Simple ,  and override the method : apply(String action, ActionResponse response, ActionListener listener).  when i invoke method: client.prepareSearch,  the apply method  was invoked twice whice is not i wanted, once is enough. is there sth i missed ?  here is my code :</p>
<p dir="auto">public static class LoggingFilter extends ActionFilter.Simple {</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="    @Inject
    public LoggingFilter(Settings settings) {
        super(settings);
    }

    @Override
    public int order() {
        return 999;
    }

    @Override
    protected boolean apply(String action, ActionRequest request, ActionListener listener) {
        return true;
    }

    @Override
    protected boolean apply(String action, ActionResponse response, ActionListener listener) {
        if (&quot;indices:data/read/search&quot;.equals(action)) {
            System.out.println(&quot;=========&quot; + action + &quot;======&quot; + listener);
            System.out.println(&quot;=========&quot; + response.hashCode() + &quot;======&quot; );
        }

        return true;
    }
}"><pre class="notranslate"><code class="notranslate">    @Inject
    public LoggingFilter(Settings settings) {
        super(settings);
    }

    @Override
    public int order() {
        return 999;
    }

    @Override
    protected boolean apply(String action, ActionRequest request, ActionListener listener) {
        return true;
    }

    @Override
    protected boolean apply(String action, ActionResponse response, ActionListener listener) {
        if ("indices:data/read/search".equals(action)) {
            System.out.println("=========" + action + "======" + listener);
            System.out.println("=========" + response.hashCode() + "======" );
        }

        return true;
    }
}
</code></pre></div>
<p dir="auto">public class ActionInvokeModule extends AbstractModule implements PreProcessModule {</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="    @Override
    protected void configure() {
        bind(LoggingFilter.class).asEagerSingleton();
    }

    @Override
    public void processModule(Module module) {
        if (module instanceof ActionModule) {
            ((ActionModule)module).registerFilter(LoggingFilter.class);
        }
    }
}"><pre class="notranslate"><code class="notranslate">    @Override
    protected void configure() {
        bind(LoggingFilter.class).asEagerSingleton();
    }

    @Override
    public void processModule(Module module) {
        if (module instanceof ActionModule) {
            ((ActionModule)module).registerFilter(LoggingFilter.class);
        }
    }
}
</code></pre></div>
<p dir="auto">public class ActionInvokePlugin extends AbstractPlugin {</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="@Override
public Collection&lt;Class&lt;? extends Module&gt;&gt; modules() {
    Collection&lt;Class&lt;? extends Module&gt;&gt; modules = new ArrayList&lt;Class&lt;? extends Module&gt;&gt;();
    modules.add(ActionLoggingModule.class);
    System.out.println(&quot;==========loaded log plugin&quot;);
    return modules;
}"><pre class="notranslate"><code class="notranslate">@Override
public Collection&lt;Class&lt;? extends Module&gt;&gt; modules() {
    Collection&lt;Class&lt;? extends Module&gt;&gt; modules = new ArrayList&lt;Class&lt;? extends Module&gt;&gt;();
    modules.add(ActionLoggingModule.class);
    System.out.println("==========loaded log plugin");
    return modules;
}
</code></pre></div>
<p dir="auto">}</p>
<p dir="auto">this is my client :<br>
<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/test/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/test">@test</a><br>
public void testSimpleSearch() {<br>
SearchResponse response = client.prepareSearch("twitter2")<br>
.setTypes("tweet2")<br>
.setSearchType(SearchType.DFS_QUERY_THEN_FETCH)<br>
.setQuery(QueryBuilders.termQuery("user", "wangwu"))             // Query<br>
.setFrom(0).setSize(60).setExplain(true)<br>
.execute()<br>
.actionGet();<br>
for (SearchHit hit : response.getHits().getHits()) {<br>
System.out.println("======" + hit.getSource());<br>
}</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="}"><pre class="notranslate"><code class="notranslate">}
</code></pre></div>
<p dir="auto">A standard GET by ID results in a single log entry in the audit log. Search (_search) results in two identical log entries. Every time.</p>
<ul dir="auto">
<li>Default ES 1.6.0 installation.</li>
<li>Added latest Shield.</li>
<li>Added "search_admin" user.</li>
</ul>
<p dir="auto">Everything works great out of the box except I get _search audits duplicated in the log. ONLY "SearchRequest" audits. I haven't found any other api yet which results in this strange behavior.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="[2015-06-16 18:37:24,705] [esdev-shieldpoc01] [transport] [access_granted]      origin_type=[rest], origin_address=[/10.30.24.36:55308], principal=[search_admin], action=[indices:data/read/search], indices=[test], request=[SearchRequest]
[2015-06-16 18:37:24,705] [esdev-shieldpoc01] [transport] [access_granted]      origin_type=[rest], origin_address=[/10.30.24.36:55308], principal=[search_admin], action=[indices:data/read/search], indices=[test], request=[SearchRequest]"><pre class="notranslate"><code class="notranslate">[2015-06-16 18:37:24,705] [esdev-shieldpoc01] [transport] [access_granted]      origin_type=[rest], origin_address=[/10.30.24.36:55308], principal=[search_admin], action=[indices:data/read/search], indices=[test], request=[SearchRequest]
[2015-06-16 18:37:24,705] [esdev-shieldpoc01] [transport] [access_granted]      origin_type=[rest], origin_address=[/10.30.24.36:55308], principal=[search_admin], action=[indices:data/read/search], indices=[test], request=[SearchRequest]
</code></pre></div>