Format `from` and `to` fields in JSON audit log

To make it possible to index the `from` and `to` fields with
Elasticsearch and other tools, we need the types to be the same.
Currently they are a mix of boolean and string values.

Part of https://gitlab.com/gitlab-org/gitlab-ee/issues/12599

app/services/audit_event_service.rb

@@ -35,8 +35,12 @@ class AuditEventService
     @file_logger ||= Gitlab::AuditJsonLogger.build
   end
 
+  def formatted_details
+    @details.merge(@details.slice(:from, :to).transform_values(&:to_s))
+  end
+
   def log_security_event_to_file
-    file_logger.info(base_payload.merge(@details))
+    file_logger.info(base_payload.merge(formatted_details))
   end
 
   def log_security_event_to_database

changelogs/unreleased/sh-audit-event-json-log-format-from-and-to.yml

+---
+title: Format `from` and `to` fields in JSON audit log
+merge_request: 30333
+author:
+type: changed

spec/services/audit_event_service_spec.rb

@@ -10,11 +10,8 @@ describe AuditEventService do
   let(:logger) { instance_double(Gitlab::AuditJsonLogger) }
 
   describe '#security_event' do
-    before do
-      expect(service).to receive(:file_logger).and_return(logger)
-    end
-
     it 'creates an event and logs to a file' do
+      expect(service).to receive(:file_logger).and_return(logger)
       expect(logger).to receive(:info).with(author_id: user.id,
                                             entity_id: project.id,
                                             entity_type: "Project",
@@ -22,5 +19,32 @@ describe AuditEventService do
 
       expect { service.security_event }.to change(SecurityEvent, :count).by(1)
     end
+
+    it 'formats from and to fields' do
+      service = described_class.new(
+        user, project,
+        {
+          from: true,
+          to: false,
+          action: :create,
+          target_id: 1
+        })
+      expect(service).to receive(:file_logger).and_return(logger)
+      expect(logger).to receive(:info).with(author_id: user.id,
+                                            entity_type: 'Project',
+                                            entity_id: project.id,
+                                            from: 'true',
+                                            to: 'false',
+                                            action: :create,
+                                            target_id: 1)
+
+      expect { service.security_event }.to change(SecurityEvent, :count).by(1)
+
+      details = SecurityEvent.last.details
+      expect(details[:from]).to be true
+      expect(details[:to]).to be false
+      expect(details[:action]).to eq(:create)
+      expect(details[:target_id]).to eq(1)
+    end
   end
 end