# Error when enabling Kibana ECS Audit

**URL:** <https://discuss.elastic.co/t/error-when-enabling-kibana-ecs-audit/275505>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [June 9, 2021, 10:05pm UTC](https://discuss.elastic.co/t/error-when-enabling-kibana-ecs-audit/275505 "2021-06-09T22:05:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![preetish\_P](https://avatars.discourse-cdn.com/v4/letter/p/77aa72/32.png) [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\
**Post date:** [June 9, 2021, 10:05pm UTC](https://discuss.elastic.co/t/error-when-enabling-kibana-ecs-audit/275505/1 "2021-06-09T22:05:49Z")

</div>

Hi All,

We recently upgraded to ES v7.11.2 and would like to use the auditing features in Kibana to monitor the usage of various dashboards by various logins. etc.

I tried to enable auditing in my local setup in macOS using below steps:

1. Installed gz package
2. Enabled 30 days trial so that x-pack is enabled
3. Enabled audit: `xpack.security.audit.enabled: true`
4. Added the below default settings which are mentioned in the guide:

```auto
xpack.security.audit.appender:
  type: rolling-file
  fileName: ./audit.log
  policy:
    type: time-interval
    interval: 24h 
  strategy:
    type: numeric
    max: 10 
  layout:
    type: json

```

Kibana was unable to start after adding these bits. The errors I am getting:

```auto
log [22:42:48.442] [fatal][root] TypeError: undefined is not iterable (cannot read property Symbol(Symbol.iterator))
    at LiteralType.handleError (KIBANA_HOME/node_modules/@kbn/config-schema/target/out/types/literal_type.js:17:25)
    at LiteralType.onError (KIBANA_HOME/node_modules/@kbn/config-schema/target/out/types/type.js:69:40)
    at type.<anonymous> (KIBANA_HOME/node_modules/@kbn/config-schema/target/out/types/type.js:41:53)
    at finish (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:529:50)
    at type._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:585:20)
    at type._base (KIBANA_HOME/node_modules/joi/lib/types/object/index.js:212:45)
    at type._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:614:37)
    at internals.Alternatives._base (KIBANA_HOME/node_modules/joi/lib/types/alternatives/index.js:60:40)
    at internals.Alternatives._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:614:37)
    at type._base (KIBANA_HOME/node_modules/joi/lib/types/object/index.js:212:45)
    at type._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:614:37)
    at type._base (KIBANA_HOME/node_modules/joi/lib/types/object/index.js:212:45)
    at type._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:614:37)
    at type._validateWithOptions (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:674:29)
    at module.exports.internals.Any.root.validate (KIBANA_HOME/node_modules/joi/lib/index.js:146:23)
    at ObjectType.validate (KIBANA_HOME/node_modules/@kbn/config-schema/target/out/types/type.js:46:72)

 FATAL TypeError: undefined is not iterable (cannot read property Symbol(Symbol.iterator))

```

Is this due to incompatible version of NodeJS or some missing plugins ? I also tried using the flat structure of YAML, but getting the same error.

Can someone please suggest any solutions to this ?

Thank you

---

<div class="post-metadata">

**Author:** ![Aaron\_Caldwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron_caldwell/32/45755_2.png) [@Aaron\_Caldwell](https://discuss.elastic.co/u/Aaron_Caldwell)\
**Post date:** [June 9, 2021, 10:47pm UTC](https://discuss.elastic.co/t/error-when-enabling-kibana-ecs-audit/275505/2 "2021-06-09T22:47:07Z")

</div>

Hello Preetish,

Just a guess at this point but have you tried providing an absolute path for `fileName`? Something like `/full/path/to/file/audit.log` using whatever your full path is.

Regards,  
Aaron

---

<div class="post-metadata">

**Author:** ![preetish\_P](https://avatars.discourse-cdn.com/v4/letter/p/77aa72/32.png) [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\
**Post date:** [June 10, 2021, 8:28am UTC](https://discuss.elastic.co/t/error-when-enabling-kibana-ecs-audit/275505/3 "2021-06-10T08:28:42Z")

</div>

Hi @Aaron_Caldwell

Tried absolute path in `fileName`, still getting the same error.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2021, 8:28am UTC](https://discuss.elastic.co/t/error-when-enabling-kibana-ecs-audit/275505/4 "2021-07-08T08:28:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.