# I Want to Audit Enabled for Kibana Dev Tools Console Queries

**URL:** <https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839>\
**Category:** Elasticsearch\
**Created:** [October 21, 2020, 12:44pm UTC](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839 "2020-10-21T12:44:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RusseL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russel/32/77328_2.png) [@RusseL](https://discuss.elastic.co/u/RusseL)\
**Post date:** [October 21, 2020, 12:44pm UTC](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839/1 "2020-10-21T12:44:39Z")

</div>

I want to keep a diary for Kibana Dev Tools Console queries. For this they told me to add `xpack.audit.enabled: true`  
line to elasticsearch.yml file and restart elasticsearch service, but when I add the line the elasticsearch service cannot be started.

---

<div class="post-metadata">

**Author:** ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)\
**Post date:** [October 21, 2020, 8:08pm UTC](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839/2 "2020-10-21T20:08:12Z")

</div>

I think [the configuration setting](https://www.elastic.co/guide/en/elasticsearch/reference/current/enable-audit-logging.html) you are looking for is `xpack.security.audit.enabled: true` -- this may be why you are unable to restart.

---

<div class="post-metadata">

**Author:** ![RusseL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russel/32/77328_2.png) [@RusseL](https://discuss.elastic.co/u/RusseL)\
**Post date:** [October 22, 2020, 8:06am UTC](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839/3 "2020-10-22T08:06:07Z")

</div>

Sorry. I typed wrong. I actually wrote this way.  
`xpack.security.audit.enabled: true`  
But not working.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2020, 8:06am UTC](https://discuss.elastic.co/t/i-want-to-audit-enabled-for-kibana-dev-tools-console-queries/252839/4 "2020-11-19T08:06:07Z")

</div>

Closed on November 19, 2020, 8:06am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.