# Capturing Comprehensive Kibana Audit Logs for User Activities
**URL:** https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954
**Category:** Kibana
**Created:** [November 22, 2024, 1:25pm UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954 "2024-11-22T13:25:34Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Akarsh\_Shaw](https://discuss.elastic.co/u/Akarsh_Shaw)
#### Post date: [November 22, 2024, 1:25pm UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/1 "2024-11-22T13:25:34Z")
Hello Elastic Community,
I am looking to implement comprehensive Kibana audit logging to monitor user activities effectively. Specifically, I want to capture the following events:
- User Login and Logout: I need to log when users log in and log out of Kibana. Currently, I understand that the login event is captured, but I would like to confirm how to also capture logout events, especially those initiated by the user and those due to session expiration.
- User Actions: I want to track all actions performed by users, including:
Creation and deletion of visualizations, dashboards, and alerts.
- Accessing different spaces and saved objects.
- Any other significant changes or interactions within Kibana.
I am currently using **ELK version 7.11.1** with a Platinum License.
From my research, I found that enabling audit logging requires setting **xpack.security.audit.enabled** to **true** in the **kibana.yml** configuration file. I tried this, but it did not work for me.
Could anyone provide insights on the following:
- What features or configurations are required to enable detailed audit logging in Kibana?
- How to set up and collect audit logs efficiently?
- Any best practices for parsing and analyzing these logs to make them actionable?
- If there are specific security settings, plugins, or tools I need to configure or integrate, I’d greatly appreciate any insights or examples.
Thanks in advance for your help!
---
### Author:  [@adilraad2001](https://discuss.elastic.co/u/adilraad2001)
#### Post date: [November 22, 2024, 1:53pm UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/2 "2024-11-22T13:53:30Z")
> [@Akarsh\_Shaw](#):
>
> ello Elastic Community,
>
> I am looking to implement comprehensive Kibana audit logging to monitor user activities effectively. Specifically, I want to capture the following events:
>
> - User Login and Logout: I need to log when users log in and log out of Kibana. Currently, I understand that the login event is captured, but I would like to confirm how to also capture logout events, especially those initiated by the user and those due to session expiration.
> - User Actions: I want to track all actions performed by users, including:
> Creation and deletion of visualizations, dashboards, and alerts.
> - Accessing different spaces and saved objects.
> - Any other significant changes or interactions within Kibana.
>
> I am currently using **ELK version 7.11.1** with a Platinum License.
>
> From my research, I found that enabling audit logging requires setting **xpack.security.audit.enabled** to **true** in the **kibana.yml** configuration file. I tried this, but it did not work for me.
>
> Could anyone provide insights on the following:
>
> - What features or configurations are required to enable detailed audit logging in Kibana?
> - How to set up and collect audit logs efficiently?
> - Any best practices for parsing and analyzing these logs to make them actionable?
> - If there are specific security settings, plugins, or tools I need to configure or integrate, I’d greatly appreciate any insights or examples.
>
> Thanks in advance for your help!
Are u using fleet server of filebeat?
for filebeat you will add the path of audit log:
filebeat.inputs:
- type: log
paths:
- audit.log
for fleet add the integration
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 22, 2024, 2:42pm UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/3 "2024-11-22T14:42:04Z")
Audit logging information for your version is here: [Audit logs | Kibana Guide [7.11] | Elastic](https://www.elastic.co/guide/en/kibana/7.11/xpack-security-audit-logging.html)
With `xpack.security.audit.enabled: true` enabling the basic audit logs -- configuring the appender is required for the remainder of the ECS logs.
The appender is configured like this:
```auto
xpack.security.audit.appender:
kind: rolling-file
path: ./audit.log
policy:
kind: time-interval
interval: 24h
strategy:
kind: numeric
max: 10
layout:
kind: json
```
The appender will write the ECS audit logs to a different file than the main kibana log.
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [November 23, 2024, 1:55pm UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/4 "2024-11-23T13:55:45Z")
Sorry to jump in the conversation, is it possible to capture Kibana audit logs in ELastic Security Serverless?
---
### Author:  [@Akarsh\_Shaw](https://discuss.elastic.co/u/Akarsh_Shaw)
#### Post date: [November 25, 2024, 10:26am UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/5 "2024-11-25T10:26:24Z")
Hi,
I tried to add below config in Kibana.yml file, but Kibana failed to start.
```auto
xpack.security.audit.enabled: true
xpack.security.audit.appender:
type: rolling-file
fileName: /var/log/kibana/audit.log
policy:
type: time-interval
interval: 24h
strategy:
type: numeric
max: 10
layout:
type: json
```
Please advise
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 25, 2024, 3:37pm UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/6 "2024-11-25T15:37:08Z")
Can you provide the error kibana printed when it failed to start?
Is your cluster basic licensed?
---
### Author:  [@Akarsh\_Shaw](https://discuss.elastic.co/u/Akarsh_Shaw)
#### Post date: [November 26, 2024, 11:04am UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/7 "2024-11-26T11:04:01Z")
Hi,
I encountered an indentation issue, but after resolving it, Kibana successfully started capturing logs. Below is the log entry I obtained. My next goal is to track specific user activities, such as:
User Actions:
- Tracking all actions performed by users, including the creation and deletion of visualizations, dashboards, index/index patterns, and alerts.
- Manual downloading of data through Discover or Visualizations.
- Accessing different spaces and saved objects.
- Any other significant changes or interactions within Kibana.
Log captured in the audit.log file:
```auto
{"@timestamp":"2024-11-26T07:44:06.369+00:00","message":"User [test_krish] has logged in using basic provider [name=basic]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":7559},"ecs":{"version":"1.6.0"},"event":{"action":"user_login","category":"authentication","outcome":"success"},"user":{"name":"test_krish","roles":["data_role_all","viewer"]},"kibana":{"authentication_provider":"basic","authentication_type":"basic","authentication_realm":"default_native","lookup_realm":"default_native"},"trace":{"id":"bf410e25-abfd-4438-bf73-cefc1a9505ac"}}
```
---
### Author:  [@Akarsh\_Shaw](https://discuss.elastic.co/u/Akarsh_Shaw)
#### Post date: [November 29, 2024, 5:25am UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/8 "2024-11-29T05:25:53Z")
Hi,
Can someone assist me with the following?
My next objective is to track specific user activities, including:
### User Actions:
- Monitoring all actions performed by users, such as creating or deleting visualizations, dashboards, index patterns, and alerts.
- Tracking manual data downloads through Discover or Visualizations.
- Recording access to different spaces and saved objects.
- Capturing any other significant changes or interactions within Kibana.
Thank you!
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 29, 2024, 6:09am UTC](https://discuss.elastic.co/t/capturing-comprehensive-kibana-audit-logs-for-user-activities/370954/9 "2024-11-29T06:09:47Z")
The next step is likely to use Filebeat to read this log and forward it to a monitoring cluster.
You can review the documentation to understand what auditing events exist and then you can perform various actions to generate audit activity into your monitoring cluster which you can then visualize and alert on.