RANGER-5404 Modify the evtTime format to avoid format errors in ES

[yunyezhang-work]

What changes were proposed in this pull request?

The HDFS audit logs were not displaying on the Ranger UI. It was discovered that the HDFS audit logs were not being written to Elasticsearch. Enabling the debug logs in the HDFS plugin revealed an error related to the evtTime format. To understand the evtTime formats accepted by Elasticsearch, we enabled Hive auditing and found that the Hive audit logs were displayed correctly on the Ranger UI. Therefore, we modified ElasticSearchAuditDestination.java to ensure that the time format in the HDFS audit logs matched that of Elasticsearch.

How was this patch tested?

To enable auditing, modify the Ranger and HDFS configurations:
Ranger: ranger.audit.elasticsearch.bootstrap.enabled=true
HDFS: xasecure.audit.is.enabled=true

Executing the basic HDFS commands revealed that the corresponding audit information is not displayed in the Ranger UI. Modify ElasticSearchAuditDestination.java, then compile and package it. Replace the newly compiled ranger-plugins-audit*.jar file in the environment. Restart Ranger and execute the HDFS commands again. Now the Ranger UI displays the audit logs.

Before fix: Only Hive audit logs are displayed.

After fix: HDFS audit logs are also displayed correctly.

[mneethiraj]

I suggest to avoid instantiation of SimpleDateFormat for each audit log; consider using a thread local as shown below:

public class ElasticSearchAuditDestination extends AuditDestination {
    ....
    private static final ThreadLocal<DateFormat> DATE_FORMAT = ThreadLocal.withInitial(() -> {
        SimpleDateFormat format = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");

        format.setTimeZone(TimeZone.getTimeZone("UTC"));

        return format;
    });

    ....

    Map<String, Object> toDoc(AuthzAuditEvent auditEvent) {
        ...
        if (eventTime != null) {
            doc.put("evtTime", DATE_FORMAT.get().format(eventTime));
        }
        ...
    }

[yunyezhang-work]

Thank you for your suggestion. I have updated the corresponding code. Please review it again.