# Documentation regarding the different activity actions (ECE v1.1) **URL:** \ **Category:** Elastic Cloud Enterprise (ECE)\ **Created:** [October 2, 2018, 9:20pm UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770 "2018-10-02T21:20:34Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Simon\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simon_khan/32/109044_2.png) [@Simon\_Khan](https://discuss.elastic.co/u/Simon_Khan)\ **Post date:** [October 2, 2018, 9:20pm UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770/1 "2018-10-02T21:20:34Z")
When reading through my clusters' activity through the following endpoint [https://www.elastic.co/guide/en/cloud-enterprise/1.1/get-es-cluster-plan-activity.html](https://www.elastic.co/guide/en/cloud-enterprise/1.1/get-es-cluster-plan-activity.html) I noticed there are different activity actions found in the [https://www.elastic.co/guide/en/cloud-enterprise/1.1/ChangeSourceInfo.html](https://www.elastic.co/guide/en/cloud-enterprise/1.1/ChangeSourceInfo.html). Specifically, in the `source.action`. The following is a list of all of the unique actions i've seen across all of my clusters. `elasticsearch.update-cluster-plan` `vacate-allocator` `elasticsearch.create-cluster` `elasticsearch.stop-cluster` `elasticsearch.reboot-cluster` `elasticsearch.restart-cluster` `create-logging-and-metrics-cluster` `create-admin-console-backend` Is there any additional documentation describing what each of these activity actions do to a cluster? Specifically, which activity actions stop and restart a cluster. Based on my own analysis, I've seen that the 3 create actions, `elasticsearch.restart-cluster` and `elasticsearch.update-cluster-plan` restart a cluster, and `elasticsearch.stop-cluster` stops a cluster. Is this a safe assumption to make that no other activity actions correspond to a restart/stop? ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [October 2, 2018, 9:46pm UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770/2 "2018-10-02T21:46:34Z")
@Simon_Khan That's a great point, we don't document the different `source.action` fields and we should. Here's the full list that can be generated by the v1 API at the moment (the last 2 from your list are special cases, those clusters are created using the legacy API; the `vacate-cluster` is also a legacy value, corresponding to `move-instances`, though that is still in use in the UI) Here's the new values that are currently accessible from plan changes (others are visible in the audit logs, eg `delete-cluster`): ```auto val `reboot-cluster` = // POST clusters/elasticsearch/:id/_restart val `restart-cluster` = // POST clusters/elasticsearch/:id/_restart val `stop-cluster` = // POST clusters/elasticsearch/:id/_shutdown val `create-cluster` = // POST clusters/elasticsearch val `update-cluster-plan` = // clusters/elasticsearch/:id val `move-instances` = // POST clusters/elasticsearch/:id/instances/:instance-list/_move ``` I added the document endpoints that can result in the different sources One complication is that `update-cluster-plan` can result in a stop or restart of a cluster, eg from the `transient.plan_configuration.cluster_reboot` (restart) or running a plan change with `transient.strategy.rolling` and `transient.strategy.rolling.group_by` `set to " __all__"` (restart), or by clearing the `cluster_topology` element (shutdown) ... basically all activities are implemented as special cases of `update-cluster-plan` ---
**Author:** ![Simon\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simon_khan/32/109044_2.png) [@Simon\_Khan](https://discuss.elastic.co/u/Simon_Khan)\ **Post date:** [October 2, 2018, 11:36pm UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770/3 "2018-10-02T23:36:44Z")
Thank you @Alex_Piggott for your quick reply, I really appreciate your help. And thank you for defining what the `update-cluster-plan` does and how it can trigger a stop event, that helps a lot. I just have a few more follow up questions from your reply. 1. You mentioned the `vacate-cluster` is a legacy value, is that true for `vacate-allocator` as well? Or `vacate-` anything for that matter? 2. Also for the audit logs, to clarify, you are referring to the Elasticsearch logs that's accessible from the ECE admin UI under the external links correct? Or is this a separate set of logs? 3. And finally, what exactly is the difference between a `restart-cluster` and a `reboot-cluster` action? The documentation for [https://www.elastic.co/guide/en/cloud-enterprise/1.1/restart-es-cluster.html](https://www.elastic.co/guide/en/cloud-enterprise/1.1/restart-es-cluster.html) states that the endpoint will restart an Elasticsearch cluster but applies a `cluster_reboot`. Thank you again for your help, it is greatly appreciated. ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [October 3, 2018, 2:10am UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770/4 "2018-10-03T02:10:32Z")
> You mentioned the `vacate-cluster` is a legacy value, is that true for `vacate-allocator` as well? Or `vacate-` anything for that matter? Apologies, `vacate-cluster` was just a typo, I meant `vacate-allocator`, there are 2 v1 API equivalents: - [Move clusters | Elastic Cloud Enterprise Reference [3.6] | Elastic](https://www.elastic.co/guide/en/cloud-enterprise/current/move-clusters.html) (allocator level) - [https://www.elastic.co/guide/en/cloud-enterprise/current/move-es-cluster-instances-advanced.html](https://www.elastic.co/guide/en/cloud-enterprise/current/move-es-cluster-instances-advanced.html) (cluster level) though both of which show up as `move-instances`. > Also for the audit logs ... Err sorry, I misspoke there. I was talking about the audit log files of all ECE API access that the `adminconsole` container in the `coordinator` role ships to the L+M cluster in ECE 2.x - but actually that log provides the endpoints, sanitized bodies, and response codes (we had at one point planned to expand the `source.action` for use in an activity log but ended up going in a different direction) > And finally, what exactly is the difference between a restart-cluster and a reboot-cluster action `reboot-cluster` starts with a running cluster and stops and then restarts each instance according to the `transient.strategy` (by default, one instance at a time) `restart-cluster` starts with a stopped cluster (ie with no instances), restores its last good configuration (and also refills it with data from its snapshot if possible). The slightly confusing bit is that they are both triggered by the `_restart` endpoint ([https://www.elastic.co/guide/en/cloud-enterprise/current/restart-es-cluster.html](https://www.elastic.co/guide/en/cloud-enterprise/current/restart-es-cluster.html)), which one happens depends on the state of the cluster. Alex ---
**Author:** ![Simon\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simon_khan/32/109044_2.png) [@Simon\_Khan](https://discuss.elastic.co/u/Simon_Khan)\ **Post date:** [October 3, 2018, 7:08pm UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770/5 "2018-10-03T19:08:43Z")
Ah I see, thank you for the clarification, that helps a lot. > [@Alex\_Piggott](#): > > Here's the full list that can be generated by the v1 API at the moment Since we will eventually be upgrading to ECE 2.0, would you mind providing the list of possible `source.action` fields for the v2 API? With the document endpoints that can result in the different sources? Just so I have an idea of what might change with the `source.action` fields in the new version. Thanks! -Simon ---
**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\ **Post date:** [October 4, 2018, 1:07pm UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770/6 "2018-10-04T13:07:52Z")
> would you mind providing the list of possible `source.action` fields for the v2 API? Actually ECE 2.0 still uses the v1 API (there are extra fields in ECE 2.0 for the new features but it is backwards-compatible with ECE 1.x) and has the same set of `source.action`s. The v2 API is under development, and will change some of the `source.action`s but it's not close enough to delivery yet to be able to share confidently any of the new values. ---
**Author:** ![Simon\_Khan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simon_khan/32/109044_2.png) [@Simon\_Khan](https://discuss.elastic.co/u/Simon_Khan)\ **Post date:** [October 4, 2018, 5:12pm UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770/7 "2018-10-04T17:12:07Z")
I see, that makes sense. thank you for all your help @Alex_Piggott! I appreciate it! -Simon ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 18, 2018, 5:12pm UTC](https://discuss.elastic.co/t/documentation-regarding-the-different-activity-actions-ece-v1-1/150770/8 "2018-10-18T17:12:15Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.