# Audit logging

**URL:** <https://discuss.elastic.co/t/audit-logging/304091>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [May 6, 2022, 6:11am UTC](https://discuss.elastic.co/t/audit-logging/304091 "2022-05-06T06:11:19Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![kartika23](https://avatars.discourse-cdn.com/v4/letter/k/3ab097/32.png) [@kartika23](https://discuss.elastic.co/u/kartika23)\
**Post date:** [May 6, 2022, 6:11am UTC](https://discuss.elastic.co/t/audit-logging/304091/1 "2022-05-06T06:11:19Z")

</div>

Hi everyone,

i am having issue in enabling audit logs in kibana server i am running kibana server with wazuh ,i have tried multiple options but it is not working

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 6, 2022, 7:01am UTC](https://discuss.elastic.co/t/audit-logging/304091/2 "2022-05-06T07:01:43Z")

</div>

Welcome to our community! 😃

Can you show us your Elasticsearch settings?  
What license level do you have?

---

<div class="post-metadata">

**Author:** ![kartika23](https://avatars.discourse-cdn.com/v4/letter/k/3ab097/32.png) [@kartika23](https://discuss.elastic.co/u/kartika23)\
**Post date:** [May 6, 2022, 7:07am UTC](https://discuss.elastic.co/t/audit-logging/304091/3 "2022-05-06T07:07:05Z")

</div>

network.host: 0.0.0.0  
node.name: node-1  
cluster.initial\_master\_nodes:  
- node-1

# - node-2

# - node-3

# discovery.seed\_hosts:

# - \<elasticsearch\_ip\_node1\>

# - \<elasticsearch\_ip\_node2\>

# - \<elasticsearch\_ip\_node3\>

cluster.name: wazuh-cluster

opendistro\_security.ssl.transport.pemcert\_filepath: /etc/elasticsearch/certs/elasticsearch.pem  
opendistro\_security.ssl.transport.pemkey\_filepath: /etc/elasticsearch/certs/elasticsearch-key.pem  
opendistro\_security.ssl.transport.pemtrustedcas\_filepath: /etc/elasticsearch/certs/root-ca.pem  
opendistro\_security.ssl.transport.enforce\_hostname\_verification: false  
opendistro\_security.ssl.transport.resolve\_hostname: false  
opendistro\_security.ssl.http.enabled: true  
opendistro\_security.ssl.http.pemcert\_filepath: /etc/elasticsearch/certs/elasticsearch.pem  
opendistro\_security.ssl.http.pemkey\_filepath: /etc/elasticsearch/certs/elasticsearch-key.pem  
opendistro\_security.ssl.http.pemtrustedcas\_filepath: /etc/elasticsearch/certs/root-ca.pem  
opendistro\_security.nodes\_dn:

- CN=node-1,OU=Docu,O=Wazuh,L=California,C=US

# - CN=node-2,OU=Docu,O=Wazuh,L=California,C=US

# - CN=node-3,OU=Docu,O=Wazuh,L=California,C=US

opendistro\_security.authcz.admin\_dn:

- CN=admin,OU=Docu,O=Wazuh,L=California,C=US

opendistro\_security.audit.type: internal\_elasticsearch  
opendistro\_security.enable\_snapshot\_restore\_privilege: true  
opendistro\_security.check\_snapshot\_restore\_write\_privileges: true  
opendistro\_security.restapi.roles\_enabled: ["all\_access", "security\_rest\_api\_access"]  
node.max\_local\_storage\_nodes: 3

path.data: /var/lib/elasticsearch  
path.logs: /var/log/elasticsearch

---

<div class="post-metadata">

**Author:** ![kartika23](https://avatars.discourse-cdn.com/v4/letter/k/3ab097/32.png) [@kartika23](https://discuss.elastic.co/u/kartika23)\
**Post date:** [May 6, 2022, 7:07am UTC](https://discuss.elastic.co/t/audit-logging/304091/4 "2022-05-06T07:07:41Z")

</div>

my Elasticsearch configuration and i am using free version

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 6, 2022, 7:16am UTC](https://discuss.elastic.co/t/audit-logging/304091/5 "2022-05-06T07:16:06Z")

</div>

It looks like you are using opensearch, that an aws product that we can't help with sorry.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2022, 7:16am UTC](https://discuss.elastic.co/t/audit-logging/304091/6 "2022-05-06T07:16:06Z")

</div>

OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2022, 7:17am UTC](https://discuss.elastic.co/t/audit-logging/304091/7 "2022-06-03T07:17:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.