log whoever connects to the kibana web interface

[clocker87 (Alex)]

Hi everyone, I need to have logs of who connects to the kibana web interface, I have several accounts and I would like to be able to monitor these accesses. I have kibana version 8.3.2, what can I do? Thank you

[Rios]

Welcome to the community!

Audit logs

[leandrojmp (Leandro Pereira)]

@clocker87

I have kibana version 8.3.2, what can I do? Thank you

As mentioned you need to enable Audit logs, but keep in mind that this is a subscription feature, which means that this will not work if you are using the Basic license, you need a paid license for this.

[yago82]

@clocker87

Hi everyone, I need to have logs of who connects to the kibana web interface, I have several accounts and I would like to be able to monitor these accesses. I have kibana version 8.3.2, what can I do?

Hi,

you can enable audit logging:

open the kibana.yml and add the following settings to enable audit logging:

xpack.security.audit.enabled: true
xpack.security.audit.appender:
  kind: file
  path: /path/to/your/audit.log
  layout:
    kind: json

Replace /path/to/your/audit.log with the path where you want to store the audit log file.

REF.

Security settings in Kibana | Kibana Guide [8.12] | Elastic

Regards

[clocker87 (Alex)]

thanks to everyone, by putting into practice solution 2 of the kibana.yml file the site becomes unreachable. can I do anything else? Thank you

[leandrojmp (Leandro Pereira)]

@clocker87

thanks to everyone, by putting into practice solution 2 of the kibana.yml file the site becomes unreachable

As mentioned, do you have a paid license? This feature will only work if you have a paid license like platinum or enterprise, it doesnt work with a basic license.