How to check the user details who delete the pipeline from Kibana or elasticseach

Elastic Stack Elasticsearch
1

Hello Everyone,

We have situation that someone has deleted one of our Logstash pipeline from kibana (centrally managing from kibana) around 30 days back but we have noticed recently.

Is there a possibility to check the user who has deleted the pipeline from any of the logs or using API etc..

FYI. Our monitoring log data is kept for last 7 days and will be purged then.

Thanks In advance for any help :slight_smile:

2

This would be shown in audit logging - Enable audit logging | Elasticsearch Guide [7.15] | Elastic. I am not sure if there is another way, or if it's logged elsewhere in the stack,

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.