open-nomad/.changelog/14212.txt

```release-note:breaking-change
audit (Enterprise): fixed inconsistency in event filter logic
```
changelog: update #14212 to breaking-change (#14292) 2022-08-24 15:36:53 +00:00			```release-note:breaking-change
docs: Update upgrade guide to reflect enterprise changes introduced in nomad-enterprise (#14212) This PR documents a change made in the enterprise version of nomad that addresses the following issue: When a user tries to filter audit logs, they do so with a stanza that looks like the following: audit { enabled = true filter "remove deletes" { type = "HTTPEvent" endpoints = ["*"] stages = ["OperationComplete"] operations = ["DELETE"] } } When specifying both an "endpoint" and a "stage", the events with both matching a "endpoint" AND a matching "stage" will be filtered. When specifying both an "endpoint" and an "operation" the events with both matching a "endpoint" AND a matching "operation" will be filtered. When specifying both a "stage" and an "operation" the events with a matching a "stage" OR a matching "operation" will be filtered. The "OR" logic with stages and operations is unexpected and doesn't allow customers to get specific on which events they want to filter. For instance the following use-case is impossible to achieve: "I want to filter out all OperationReceived events that have the DELETE verb". 2022-08-24 14:31:49 +00:00			`audit (Enterprise): fixed inconsistency in event filter logic`
			```