How to know when indices mapping was updated

[pratik_jain163 (Pratik Jain)]

hi All,

Someone has updated the mapping of any indices, so I want to know how we can find this.
And also, is there a way we can get all indices to also get udpated.
and if we want to enable auditing in ES how we can do.

[iulia (Iulia Feroli)]

Hi!
When you create a new mapping and then reindex your index to the new mapping, you can add the parameter wait_for_completion=False which will create a task ID for you to keep track of the process with.

Reindex API | Elasticsearch Guide [8.10] | Elastic

Then you can use the tasks API to search through these tasks and see when a reindex task has been completed by searching with the ID, or even searching for all tasks of that kind.

Task management API | Elasticsearch Guide [8.10] | Elastic

It is also recommended to use the reindex API if you want to reindex multiple indeces, one by one. ( Reindex API | Elasticsearch Guide [8.10] | Elastic)

[pratik_jain163 (Pratik Jain)]

Thanks for the reply, but I want to know when indices or mapping are updated.
For auditing purposes, I am asking.
if a task is present it will impact performance and without task how we can get.

[leandrojmp (Leandro Pereira)]

@pratik_jain163

Someone has updated the mapping of any indices, so I want to know how we can find this.
And also, is there a way we can get all indices to also get udpated.
and if we want to enable auditing in ES how we can do.

You would need to have audit logs enabled, audit logs are available if you have a paid license.

Without audit logs you cannot know who updated anything.

[Sunile_Manjee]

@leandrojmp

Without audit logs you cannot know who updated anything

I thought about this approach and resisted responding to the question. From what I can tell (based on research), the audit events do not specifically include when a mapping is updated based on events captured: Audit events | Elasticsearch Guide [8.11] | Elastic

[stephenb (Stephen Brown)]

Hi everyone let me clarify a bit

1. As @leandrojmp mentioned auditing requires a commercial license
2. As @Sunile_Manjee mentioned updates to mappings is not one of the simple events that is easily auditable
3. You can do it by enabling REST logging audit logging and capturing the body of these REST events and then filtering and search on them. THIS can generate a large volume of data. And is usually a method of last resort.

In general, the more preferred approach is to apply Role Based Control on your non-admin users on the index privileges

Security privileges | Elasticsearch Guide [8.10] | Elastic

[pratik_jain163 (Pratik Jain)]

@leandrojmp

Without audit logs you cannot know who updated anything.

thanks for the reply but enabling REST will create huge data and it can impact performance correct.

i think we should get some feature that will add some additional fields in index such as last_update time something like that.