# Enabling kibana Audit logs to monitor login/logout activities
**URL:** https://discuss.elastic.co/t/enabling-kibana-audit-logs-to-monitor-login-logout-activities/349760
**Category:** Kibana
**Tags:** elastic-stack-monitoring
**Created:** [December 21, 2023, 5:40am UTC](https://discuss.elastic.co/t/enabling-kibana-audit-logs-to-monitor-login-logout-activities/349760 "2023-12-21T05:40:03Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)
#### Post date: [December 21, 2023, 5:40am UTC](https://discuss.elastic.co/t/enabling-kibana-audit-logs-to-monitor-login-logout-activities/349760/1 "2023-12-21T05:40:03Z")
Hello team,
We are enabling kibana Audit logs to monitor login/logout activities. But we need only authentication type logs and event.category: database or web we need to drop.
We have added below config in kibana.yml and it is working as expected.
```auto
xpack.security.audit.enabled: true
xpack.security.audit.ignore_filters: // filter out database and weblog
- categories: [database,web]
```
But, there are certain unwanted logs are coming from other sources where `event.category: database` is present. We are unable to drop these logs and it is getting ingested into Elasticsearch which taking unnecessary space in our ELK server.
Can you please let us know is there any way to drop all these below events.
Can you please help us to drop logs from below `log.file.path:`
```auto
/app/logs/0c80175b078c444aa4772b5090b91985_server.json
/app/logs/kibana-json.log
/app/logs/gc.output
/app/elastic-agent/data/logs/elastic-agent-20231218.ndjson
```
Need Below logs only:
Need to get only logs where `event.category: authentication` and `log.file.path: /app/logs/kibana_audit.json`
---
### Author:  [@yago82](https://discuss.elastic.co/u/yago82)
#### Post date: [December 24, 2023, 3:01pm UTC](https://discuss.elastic.co/t/enabling-kibana-audit-logs-to-monitor-login-logout-activities/349760/2 "2023-12-24T15:01:36Z")
Hi,
you can use a drop processor in an ingest pipeline.
> **[Drop processor | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/drop-processor.html#drop-processor)**
---
### Author:  [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)
#### Post date: [December 25, 2023, 8:59am UTC](https://discuss.elastic.co/t/enabling-kibana-audit-logs-to-monitor-login-logout-activities/349760/3 "2023-12-25T08:59:20Z")
Hi @yago82 ,
thanks for your response . I am able to manage drop events from below files.
```auto
filebeat-8.11.1-elasticsearch-gc-pipeline
ctx.log.file.path.contains ('/app/logs/gc.output')
/app/logs/gc.output
filebeat-8.11.1-kibana-log-pipeline-ecs
ctx.log.file.path.contains ('/app/logs/kibana-json.log')
/app/logs/kibana-json.log
filebeat-8.11.1-elasticsearch-audit-pipeline-json
ctx.log.file.path.contains ('server') || ctx.log.file.path.contains ('/app/elastic-agent/data/logs')
/app/logs/0c80175b078c444aa4772b5090b91985_server.json
```
But i am not able to get below one file which ingest pipeline it is using.
```auto
/app/elastic-agent/data/logs/elastic-agent-20231225.ndjson
```
Can you please help me to identify default ingest pipeline name for above file location
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 22, 2024, 8:59am UTC](https://discuss.elastic.co/t/enabling-kibana-audit-logs-to-monitor-login-logout-activities/349760/4 "2024-01-22T08:59:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.