# log whoever connects to the kibana web interface

**URL:** <https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222>\
**Category:** Kibana\
**Created:** [January 31, 2024, 7:00pm UTC](https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222 "2024-01-31T19:00:51Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![clocker87](https://avatars.discourse-cdn.com/v4/letter/c/848f3c/32.png) [@clocker87](https://discuss.elastic.co/u/clocker87)\
**Post date:** [January 31, 2024, 7:00pm UTC](https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222/1 "2024-01-31T19:00:51Z")

</div>

Hi everyone, I need to have logs of who connects to the kibana web interface, I have several accounts and I would like to be able to monitor these accesses. I have kibana version 8.3.2, what can I do? Thank you

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 31, 2024, 8:43pm UTC](https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222/2 "2024-01-31T20:43:52Z")

</div>

Welcome to the community!

[Audit logs](https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 31, 2024, 8:53pm UTC](https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222/3 "2024-01-31T20:53:18Z")

</div>

> [@clocker87](#):
>
> I have kibana version 8.3.2, what can I do? Thank you

As mentioned you need to enable Audit logs, but keep in mind that this is a subscription feature, which means that this will not work if you are using the Basic license, you need a paid license for this.

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [January 31, 2024, 9:22pm UTC](https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222/4 "2024-01-31T21:22:48Z")

</div>

> [@clocker87](#):
>
> Hi everyone, I need to have logs of who connects to the kibana web interface, I have several accounts and I would like to be able to monitor these accesses. I have kibana version 8.3.2, what can I do?

Hi,

you can enable audit logging:

open the `kibana.yml` and add the following settings to enable audit logging:

```auto
xpack.security.audit.enabled: true
xpack.security.audit.appender:
  kind: file
  path: /path/to/your/audit.log
  layout:
    kind: json

```

Replace `/path/to/your/audit.log` with the path where you want to store the audit log file.

REF.

> **[Security settings in Kibana | Kibana Guide \[8.12\] | Elastic](https://www.elastic.co/guide/en/kibana/current/security-settings-kb.html#audit-logging-settings)**

Regards

---

<div class="post-metadata">

**Author:** ![clocker87](https://avatars.discourse-cdn.com/v4/letter/c/848f3c/32.png) [@clocker87](https://discuss.elastic.co/u/clocker87)\
**Post date:** [February 1, 2024, 9:18am UTC](https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222/5 "2024-02-01T09:18:26Z")

</div>

thanks to everyone, by putting into practice solution 2 of the kibana.yml file the site becomes unreachable. can I do anything else? Thank you

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 1, 2024, 9:44am UTC](https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222/6 "2024-02-01T09:44:58Z")

</div>

> [@clocker87](#):
>
> thanks to everyone, by putting into practice solution 2 of the kibana.yml file the site becomes unreachable

As mentioned, do you have a paid license? This feature will only work if you have a paid license like platinum or enterprise, it doesnt work with a basic license.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 29, 2024, 9:45am UTC](https://discuss.elastic.co/t/log-whoever-connects-to-the-kibana-web-interface/352222/7 "2024-02-29T09:45:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.