How to track the user commands in Kibana?

[Shiva_Subramaniyan]

Hi,

We have already installed auditbeat and metricbeat agents (version 7.10.2) on our RHEL / Linux servers and we want to track the "commands" that the user had executed on the server through Kibana dashboards. We do not have logstash and we are shipping the logs directly from the servers to the elasticsearch nodes and then to Kibana.

Can someone help us on this?

[jsanz (Jorge Sanz)]

Both Elasticsearch and Kibana have modules on metricbeat to monitor them:

• Elasticsearch module | Metricbeat Reference [8.6] | Elastic
• Kibana module | Metricbeat Reference [8.6] | Elastic

And the same applies to filebeat:

• Elasticsearch module | Filebeat Reference [8.6] | Elastic
• Kibana module | Filebeat Reference [8.6] | Elastic

Everything is also available as integrations through Elastic agent:

• Elasticsearch | Elastic docs
• Kibana | Elastic docs

Apart from that, depending on your suscription you can also enable audit logging for the stack and more concretely, you can audit search queries.

Hope it helps!

[warkolm (Mark Walkom)]

FYI 7.10 is EOL and no linger supported, please upgrade