# How to view docs.deleted data

**URL:** <https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459>\
**Category:** Elasticsearch\
**Created:** [September 29, 2022, 1:48pm UTC](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459 "2022-09-29T13:48:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![KrishnaCh](https://avatars.discourse-cdn.com/v4/letter/k/df788c/32.png) [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\
**Post date:** [September 29, 2022, 1:48pm UTC](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459/1 "2022-09-29T13:48:35Z")

</div>

Hi All,  
In my elastic cluster, I see there are some records in **docs.deleted** for some of the indices, and I am not sure how to find out who deleted the docs?  
My 3 node elastic cluster version is **7.16.1** and it is Not an enterprise version, and we are using a free opensource version.

I tried enabling **xpack.security.audit.enabled** in elastic config on all nodes and restarted cluster, and manually deleted records to check if its getting logged, but its not writing anything in the audit log file.

Is the auditing feature is available ONLY on the enterprise version?

Can anyone please help me how to find out the docs.deleted data?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 29, 2022, 2:01pm UTC](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459/2 "2022-09-29T14:01:19Z")

</div>

> [@KrishnaCh](#):
>
> Is the auditing feature is available ONLY on the enterprise version?

The audit log feature requires a [platinum or higher license](https://www.elastic.co/subscriptions).

> [@KrishnaCh](#):
>
> Can anyone please help me how to find out the docs.deleted data?

That is not possible. Be aware that updates show up as a index and a delete, so it is not becessary that any documents have been deleted.

---

<div class="post-metadata">

**Author:** ![KrishnaCh](https://avatars.discourse-cdn.com/v4/letter/k/df788c/32.png) [@KrishnaCh](https://discuss.elastic.co/u/KrishnaCh)\
**Post date:** [September 29, 2022, 2:29pm UTC](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459/3 "2022-09-29T14:29:41Z")

</div>

Thank you Christian for your response.

> [@Christian\_Dahlqvist](#):
>
> The audit log feature requires a [platinum or higher license](https://www.elastic.co/subscriptions).

Okay. Noted.

> [@Christian\_Dahlqvist](#):
>
> That is not possible. Be aware that updates show up as a index and a delete, so it is not becessary that any documents have been deleted.

Okay, so do you mean that if **same** document when indexed again, will result as updates, and it will do a delete and index That document again? Is my understanding correct?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2022, 2:30pm UTC](https://discuss.elastic.co/t/how-to-view-docs-deleted-data/315459/4 "2022-10-27T14:30:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.