# Change or Removal of system log contents

**URL:** <https://discuss.elastic.co/t/change-or-removal-of-system-log-contents/75018>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 14, 2017, 11:20am UTC](https://discuss.elastic.co/t/change-or-removal-of-system-log-contents/75018 "2017-02-14T11:20:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rajasekaran\_Mari](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Rajasekaran\_Mari](https://discuss.elastic.co/u/Rajasekaran_Mari)\
**Post date:** [February 14, 2017, 11:20am UTC](https://discuss.elastic.co/t/change-or-removal-of-system-log-contents/75018/1 "2017-02-14T11:20:55Z")

</div>

Hi,

How to write a json script if anyone change or Removal of system log contents.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 15, 2017, 10:41am UTC](https://discuss.elastic.co/t/change-or-removal-of-system-log-contents/75018/2 "2017-02-15T10:41:57Z")

</div>

Hi

can you please be more specific with your requirements (and not cross post or create new posts).  
How are you logging your 'removal of system log contents' into elasticsearch? Can you query this state? If so, you can create a watch, but watcher is not a file system monitoring system.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2017, 10:42am UTC](https://discuss.elastic.co/t/change-or-removal-of-system-log-contents/75018/3 "2017-03-15T10:42:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.