Add stdout as an optional audit backend

[broamski]

If deploying vault in a container, it is convenient to be able to write audit logs to stdout so that they can be picked up via standard container log collection methods.

This also eliminates the need to worry about log rotation inside of a container.

[jefferai]

I worry about interleaving issues here given that Vault also writes things to stdout at various points.

[broamski]

I agree with you on this one. You can accomplish the same end goal as this PR by setting the file-path backend to a symbolic link that targets /dev/stdout. I submitted this because it feels a bit more proper and not as clunky as the aforementioned solution. I'd hope any user's log aggregation tool of choice could be able to discern structured vs. unstructured data.

Some top-of-mind solutions to avoid interleaving are:

1. Add an option to output application logs to its own logging backend. This seems to go against the logxi manifesto - https://github.com/mgutz/logxi#extending
2. Add an option to output application logs as json

[broamski]

Pardon my ignorance, it looks like VAULT_LOG_FORMAT=json is already a thing.

[jefferai]

VAULT_LOG_FORMAT is a non-documented thing because we don't yet promise that the output will not change. We are likely not to stick with logxi long-term although we think that with any other logging library we will still keep this format (we have some internal discussions around standardized structured logging to implement across projects). We don't really feel beholden to the logxi manifesto -- it's just a tool :-)

One way that this could possibly be accomplished would be to not write directly to stdout but instead to pass in the logger in use by the rest of Vault and use its underlying output, since this is mutex-protected to avoid interleaving. I don't remember offhand whether there is direct access to the output but that's potentially something we could add. Essentially, if looking at the logformat package, return a vaultFormatter with a shared mutex, then add a "raw" style. The writer itself would have to get plumbed out too, though.

[jefferai]

Closing in favor of the work going on in #3235