# Elk audit logs

**URL:** <https://discuss.elastic.co/t/elk-audit-logs/349924>\
**Category:** Kibana\
**Tags:** elastic-stack-monitoring\
**Created:** [December 26, 2023, 5:10am UTC](https://discuss.elastic.co/t/elk-audit-logs/349924 "2023-12-26T05:10:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![theacodes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theacodes/32/113779_2.png) [@theacodes](https://discuss.elastic.co/u/theacodes)\
**Post date:** [December 26, 2023, 5:10am UTC](https://discuss.elastic.co/t/elk-audit-logs/349924/1 "2023-12-26T05:10:32Z")

</div>

Hey!

I'm using on-prem ELK v8.1  
I want to check the audit logs of ELK.  
which user did what activity, what rules are disabled by users, and what modifications are done by them. Currently, I'm using the basic version with no license subscription.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 26, 2023, 12:28pm UTC](https://discuss.elastic.co/t/elk-audit-logs/349924/2 "2023-12-26T12:28:19Z")

</div>

> [@theacodes](#):
>
> Currently, I'm using the basic version with no license subscription.

To use the audit logs you need a paid license, it does not work with the Basic license.

---

<div class="post-metadata">

**Author:** ![theacodes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theacodes/32/113779_2.png) [@theacodes](https://discuss.elastic.co/u/theacodes)\
**Post date:** [December 27, 2023, 5:58am UTC](https://discuss.elastic.co/t/elk-audit-logs/349924/3 "2023-12-27T05:58:51Z")

</div>

Thanks for the confirmation @leandrojmp

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 24, 2024, 5:58am UTC](https://discuss.elastic.co/t/elk-audit-logs/349924/4 "2024-01-24T05:58:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.