# How we can drop transport event type in Elasticsearch 8.12 version **URL:** \ **Category:** Elasticsearch\ **Created:** [February 2, 2024, 5:31am UTC](https://discuss.elastic.co/t/how-we-can-drop-transport-event-type-in-elasticsearch-8-12-version/352358 "2024-02-02T05:31:02Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ashishshukla](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@ashishshukla](https://discuss.elastic.co/u/ashishshukla)\ **Post date:** [February 2, 2024, 5:31am UTC](https://discuss.elastic.co/t/how-we-can-drop-transport-event-type-in-elasticsearch-8-12-version/352358/1 "2024-02-02T05:31:02Z")
Hi Team, I am getting system generated log in Elasticsearch Audit logs file. can you please provide me solution to avoid the system generated logs in audit log. **I did below configuration in elasticsearch.yml file** Microsoft Windows [Version 10.0.22000.2713] (c) Microsoft Corporation. All rights reserved. C:\Users\ashishkumar\_shukla\Downloads\>ssh -i "elasticsearch22\_key.pem" [ec2-user@ec2-43-205-211-14.ap-south-1.compute.amazonaws.com](mailto:ec2-user@ec2-43-205-211-14.ap-south-1.compute.amazonaws.com) The authenticity of host '[ec2-43-205-211-14.ap-south-1.compute.amazonaws.com](http://ec2-43-205-211-14.ap-south-1.compute.amazonaws.com) (43.205.211.14)' can't be established. ECDSA key fingerprint is SHA256:ZHRRohLx7VLL0HNpOAuQdO6Yka0LHnNnxLfCsJpmFyI. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[ec2-43-205-211-14.ap-south-1.compute.amazonaws.com](http://ec2-43-205-211-14.ap-south-1.compute.amazonaws.com),43.205.211.14' (ECDSA) to the list of known hosts. Register this system with Red Hat Insights: insights-client --register Create an account or view all your systems at [Hybrid Cloud Console](https://red.ht/insights-dashboard) Last login: Wed Jan 31 13:36:19 2024 from 103.92.43.94 [ec2-user@ip-172-31-39-77 ~]$ sudo su [root@ip-172-31-39-77 ec2-user]# cat etc/elasticsearch/elasticsearch.yml cat: etc/elasticsearch/elasticsearch.yml: No such file or directory [root@ip-172-31-39-77 ec2-user]# cat /etc/elasticsearch/elasticsearch.yml # ======================== Elasticsearch Configuration ========================= # # NOTE: Elasticsearch comes with reasonable defaults for most settings. # Before you set out to tweak and tune the configuration, make sure you # understand what are you trying to accomplish and the consequences. # # The primary way of configuring a node is via this file. This template lists # the most important settings you may want to configure for a production cluster. # # Please consult the documentation for further information on configuration options: # [Elasticsearch Guide | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/index.html) # # ---------------------------------- Cluster ----------------------------------- # # Use a descriptive name for your cluster: # cluster.name: my-application1 # # ------------------------------------ Node ------------------------------------ # # Use a descriptive name for the node: # node.name: node-1 # # Add custom attributes to the node: # #node.attr.rack: r1 # # ----------------------------------- Paths ------------------------------------ # # Path to directory where to store the data (separate multiple locations by comma): # path.data: /var/lib/elasticsearch # # Path to log files: # path.logs: /var/log/elasticsearch # # ----------------------------------- Memory ----------------------------------- # # Lock the memory on startup: # #bootstrap.memory\_lock: true # # Make sure that the heap size is set to about half the memory available # on the system and that the owner of the process is allowed to use this # limit. # # Elasticsearch performs poorly when the system is swapping the memory. # # ---------------------------------- Network ----------------------------------- # # By default Elasticsearch is only accessible on localhost. Set a different # address here to expose this node on the network: # network.host: 172.31.39.77 # # By default Elasticsearch listens for HTTP traffic on the first free port it # finds starting at 9200. Set a specific HTTP port here: # http.port: 9200 # # For more information, consult the network module documentation. # # --------------------------------- Discovery ---------------------------------- # # Pass an initial list of hosts to perform discovery when this node is started: # The default list of hosts is ["127.0.0.1", "[::1]"] # #discovery.seed\_hosts: ["host1", "host2"] # # Bootstrap the cluster using an initial set of master-eligible nodes: # #cluster.initial\_master\_nodes: ["node-1", "node-2"] # # For more information, consult the discovery and cluster formation module documentation. # # ---------------------------------- Various ----------------------------------- # # Allow wildcard deletion of indices: # #action.destructive\_requires\_name: false #----------------------- BEGIN SECURITY AUTO CONFIGURATION ----------------------- # # The following settings, TLS certificates, and keys have been automatically # generated to configure Elasticsearch security features on 22-01-2024 12:06:59 # # -------------------------------------------------------------------------------- # Enable security features xpack.security.enabled: true xpack.security.enrollment.enabled: true xpack.security.audit.enabled : true xpack.security.audit.logfile.events.include: ["authentication\_success","authentication\_failed"] xpack.security.audit.logfile.events.emit\_request\_body : true xpack.security.audit.logfile.emit\_node\_name : true xpack.security.audit.logfile.emit\_node\_host\_address : true xpack.security.audit.logfile.emit\_node\_host\_name: true xpack.security.audit.logfile.emit\_node\_id: true xpack.license.self\_generated.type: trial # Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents xpack.security.http.ssl: enabled: false keystore.path: certs/http.p12 # Enable encryption and mutual authentication between cluster nodes xpack.security.transport.ssl: enabled: false verification\_mode: certificate keystore.path: certs/transport.p12 truststore.path: certs/transport.p12 # Create a new cluster with the current node only # Additional nodes can still join the cluster later #cluster.initial\_master\_nodes: ["ip-172-31-39-77.ap-south-1.compute.internal"] discovery.type: single-node # Allow HTTP API connections from anywhere # Connections are encrypted and require user authentication http.host: 0.0.0.0 # Allow other nodes to join the cluster from anywhere # Connections are encrypted and mutually authenticated #transport.host: 0.0.0.0 #----------------------- END SECURITY AUTO CONFIGURATION ------------------------- [root@ip-172-31-39-77 ec2-user]# **Example of system generated audit log** {"type":"audit", "timestamp":"2024-01-31T13:01:05,961+0000", "cluster.uuid":"aqyZaw7QTgKfg0neAFQ1ig", "node.name":"node-1", "node.id":"6NN4AY\_yRhqyXQ\_9i4RQ-w", "host.name":"172.31.39.77", "host.ip":"172.31.39.77", "event.type":"transport", "event.action":"authentication\_success", "authentication.type":"INTERNAL", "user.name":"\_system", "user.realm":"\_\_fallback", "origin.type":"local\_node", "origin.address":"172.31.39.77:9300", "request.id":"Xxi5qsZ5RzmrSAsjH9sS3Q", "action":"cluster:monitor/update/health/info", "request.name":"Request"} {"type":"audit", "timestamp":"2024-01-31T13:06:05,954+0000", "cluster.uuid":"aqyZaw7QTgKfg0neAFQ1ig", "node.name":"node-1", "node.id":"6NN4AY\_yRhqyXQ\_9i4RQ-w", "host.name":"172.31.39.77", "host.ip":"172.31.39.77", "event.type":"transport", "event.action":"authentication\_success", "authentication.type":"INTERNAL", "user.name":"\_system", "user.realm":"\_\_fallback", "origin.type":"local\_node", "origin.address":"172.31.39.77:9300", "request.id":"tux-hSILReit31XuPnWNtg", "action":"cluster:monitor/update/health/info", "request.name":"Request"} ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 2, 2024, 5:43am UTC](https://discuss.elastic.co/t/how-we-can-drop-transport-event-type-in-elasticsearch-8-12-version/352358/2 "2024-02-02T05:43:40Z")
You cannot (and should not) filter based on the `event.type`, you can add an ignore policy for particular user names - [Logfile audit events ignore policies | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/audit-log-ignore-policy.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 1, 2024, 7:05am UTC](https://discuss.elastic.co/t/how-we-can-drop-transport-event-type-in-elasticsearch-8-12-version/352358/4 "2024-03-01T07:05:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.