# Enable Audit Logging IN Elasticsearch For a User
**URL:** https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227
**Category:** Elasticsearch
**Created:** [May 10, 2024, 5:24am UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227 "2024-05-10T05:24:56Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)
#### Post date: [May 10, 2024, 5:24am UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227/1 "2024-05-10T05:24:56Z")
Hello Team,
We require to enable an audit for a specific user, meaning that whenever the user logs in or performs any CRUD operations in Elasticsearch, it should be recorded. The user has reported intermittent connectivity and query issues with Elasticsearch without any specfic pattern, making it difficult for us to troubleshoot. Therefore, we are considering to implment an audit trail for this user. The application is developed using Node.js. Could you kindly assist us in understanding how we can accomplish this within Elasticsearch?
Thank you,
Debasis
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 10, 2024, 5:31am UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227/2 "2024-05-10T05:31:52Z")
You can do this through [audit logging](https://www.elastic.co/guide/en/elasticsearch/reference/8.13/enable-audit-logging.html) in Elasticsearch. Note that [this does require a commercial license](https://www.elastic.co/subscriptions) and is not available with the free Basic license. If that is not an option you may need to implement this yourself in some kind of proxy ahead of Elasticsearch.
---
### Author:  [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)
#### Post date: [May 10, 2024, 7:22am UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227/3 "2024-05-10T07:22:10Z")
Thanks for response. As I mentioned above any way to audit user level all activities starting from connection creation to all kind of CRUD operations he is perfroming.
Thanks,
Debasis
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 10, 2024, 7:42am UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227/4 "2024-05-10T07:42:55Z")
The audit logging I mentioned will log what Elasticsearch sees in terms of user interaction. Issues the customer sees from the client side that prevent connection to Elasticsearch, e.g. DNS or network issues, is only available to the client so would need to be logged there.
---
### Author:  [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)
#### Post date: [May 10, 2024, 12:33pm UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227/5 "2024-05-10T12:33:26Z")
In my deployment, the parameter is set to true, but the mobelastic\_audit.json file does not contain any records. We had basic licensing, could this be the reason why the audit file contains zero records?
Could you please confirm?
`xpack.security.enabled: true`
Thanks,
Debasis
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 10, 2024, 12:40pm UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227/6 "2024-05-10T12:40:06Z")
> [@Debasis\_Mallick](#):
>
> We had basic licensing, could this be the reason why the audit file contains zero records?
Yes. As I mentioned earlier this feature requires a commercial license.
---
### Author:  [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)
#### Post date: [May 10, 2024, 1:09pm UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227/7 "2024-05-10T13:09:06Z")
> [@Christian\_Dahlqvist](#):
>
> Yes. As I mentioned earlier this feature requires a commercial license.
I am currently utilizing version 8.12 of Elasticsearch. Are you suggesting that it operates with a BASIC license? If so, I am curious as to why the file `mobelastic_audit.json` contains zero records.
Is there something we may be overlooking?
Thanks,
Debasis
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [May 10, 2024, 1:16pm UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227/8 "2024-05-10T13:16:19Z")
> [@Debasis\_Mallick](#):
>
> I am currently utilizing version 8.12 of Elasticsearch. Are you suggesting that it operates with a BASIC license?
If you do not have a paid license on the platinum or enterprise level, then you are using the basic license.
The audit logs are a paid feature, so you will not be able to get any audit logs with the basic license.
You can check the differences of each license tier [here](https://www.elastic.co/subscriptions).