Hello, Community.
I want to collect audit logs connected to user activity (like user create/delete, set/change password, create new role, delete role, change role, change user role, success/failed auth etc.) Is it possible to log all these actions?
For example, I found auth logs in elasticsearch.log. But get user creation/deletion events was difficult. For this, I prescribed the following construction in kibana.yml:
logging:
appenders:
audit_file:
type: file
fileName: /var/log/kibana/audit.log
layout:
type: json
loggers:
- name: plugins.security.audit
level: debug
appenders: [audit_file]
- name: plugins.security
level: debug
appenders: [audit_file]
- name: http.server.response
level: debug
appenders: [audit_file]
And only on level debug of http.server.response category i found this logs. So, are there any easier way to get this events? Has anyone encountered such a case?