# How to track the user commands in Kibana?

**URL:** <https://discuss.elastic.co/t/how-to-track-the-user-commands-in-kibana/323092>\
**Category:** Kibana\
**Created:** [January 13, 2023, 7:01am UTC](https://discuss.elastic.co/t/how-to-track-the-user-commands-in-kibana/323092 "2023-01-13T07:01:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shiva\_Subramaniyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shiva_subramaniyan/32/81251_2.png) [@Shiva\_Subramaniyan](https://discuss.elastic.co/u/Shiva_Subramaniyan)\
**Post date:** [January 13, 2023, 7:01am UTC](https://discuss.elastic.co/t/how-to-track-the-user-commands-in-kibana/323092/1 "2023-01-13T07:01:37Z")

</div>

Hi,

We have already installed auditbeat and metricbeat agents (version 7.10.2) on our RHEL / Linux servers and we want to track the "commands" that the user had executed on the server through Kibana dashboards. We do not have logstash and we are shipping the logs directly from the servers to the elasticsearch nodes and then to Kibana.

Can someone help us on this?

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [January 16, 2023, 5:48pm UTC](https://discuss.elastic.co/t/how-to-track-the-user-commands-in-kibana/323092/2 "2023-01-16T17:48:10Z")

</div>

Both Elasticsearch and Kibana have modules on metricbeat to monitor them:

- [Elasticsearch module | Metricbeat Reference [8.6] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-elasticsearch.html)
- [Kibana module | Metricbeat Reference [8.6] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-kibana.html)

And the same applies to filebeat:

- [Elasticsearch module | Filebeat Reference [8.6] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-elasticsearch.html)
- [Kibana module | Filebeat Reference [8.6] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-kibana.html)

Everything is also available as [integrations](https://docs.elastic.co/integrations) through Elastic agent:

- [Elasticsearch | Elastic docs](https://docs.elastic.co/integrations/elasticsearch)
- [Kibana | Elastic docs](https://docs.elastic.co/integrations/kibana)

Apart from that, depending on your suscription you can also enable audit logging for the stack and more concretely, you can [audit search queries](https://www.elastic.co/guide/en/elasticsearch/reference/8.6/auditing-search-queries.html).

Hope it helps!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 17, 2023, 1:49am UTC](https://discuss.elastic.co/t/how-to-track-the-user-commands-in-kibana/323092/3 "2023-01-17T01:49:14Z")

</div>

FYI 7.10 is [EOL](https://www.elastic.co/support/eol) and no linger supported, please upgrade 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2023, 1:49am UTC](https://discuss.elastic.co/t/how-to-track-the-user-commands-in-kibana/323092/4 "2023-02-14T01:49:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.