# Delete: xpack.security.audit.index

**URL:** <https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772>\
**Category:** Elasticsearch\
**Created:** [October 12, 2017, 5:08pm UTC](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772 "2017-10-12T17:08:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![eramitsinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eramitsinha/32/35032_2.png) [@eramitsinha](https://discuss.elastic.co/u/eramitsinha)\
**Post date:** [October 12, 2017, 5:08pm UTC](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772/1 "2017-10-12T17:08:10Z")

</div>

Hi,

I am using Elastic Search 5.2.2, Kibana 5.2.2 and X-Pack 5.2.2

I have enabled auditing on my cluster, so this is working fine as I could see ".security\_audit\_log" index are getting generated.

**But would like to understand is there any mechanism to archieve and delete Audit Indexes.**

Similar to monitoring mechanism(xpack.monitoring.history.duration)

Thanks,  
Amit Sinha.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 13, 2017, 1:26am UTC](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772/2 "2017-10-13T01:26:18Z")

</div>

> [@eramitsinha](#):
>
> But would like to understand is there any mechanism to archieve and delete Audit Indexes.

There is nothing built-in to X-Pack for this. You can use [curator](https://github.com/elastic/curator) to automate the removal of indices.

---

<div class="post-metadata">

**Author:** ![eramitsinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eramitsinha/32/35032_2.png) [@eramitsinha](https://discuss.elastic.co/u/eramitsinha)\
**Post date:** [October 13, 2017, 5:09pm UTC](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772/3 "2017-10-13T17:09:50Z")

</div>

Thank You.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 10, 2017, 5:09pm UTC](https://discuss.elastic.co/t/delete-xpack-security-audit-index/103772/4 "2017-11-10T17:09:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.