When logging to Elastic Search with the current Audit Trail plugin there is no controller-unique information in the log messages. Insted you have to configure difrerent Jenkins controllers to log to different indexes to be able to tell tell the log sources apart in Elastic.

This also makes index and life cycle management harder, since it need to be configured individually for each index.

By adding some fields/keys to the log documents being sent to Elastic Search that identifies the source controller it would make it possible to have multiple controllers log to the same index. This would also enable simpler management of log data and indexes through a single set of configurations.