# Monitor failed elastic user logins **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [September 26, 2020, 7:39am UTC](https://discuss.elastic.co/t/monitor-failed-elastic-user-logins/250045 "2020-09-26T07:39:29Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Post date:** [September 26, 2020, 7:39am UTC](https://discuss.elastic.co/t/monitor-failed-elastic-user-logins/250045/1 "2020-09-26T07:39:29Z")
Hi, I was wondering if there is a way to temporarily ban an IP or even a user profile who entered its password wrong for N time. In general, is there a way to monitor user login attempts and automatically act upon it? ---
**Author:** ![Emanuil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emanuil/32/36783_2.png) [@Emanuil](https://discuss.elastic.co/u/Emanuil)\ **Post date:** [September 26, 2020, 10:54pm UTC](https://discuss.elastic.co/t/monitor-failed-elastic-user-logins/250045/2 "2020-09-26T22:54:39Z")
For simply monitoring login attempts, I highly recommend [this blog post](https://www.elastic.co/blog/indexing-elasticsearch-audit-logs-with-filebeat) (starting from "Using Filebeat to ingest Elasticsearch audit logs") and the security audit docs that it links to. I believe we don't offer login rate limiting at the time, but you can [track the development of the issue here](https://github.com/elastic/kibana/issues/18491). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 24, 2020, 10:54pm UTC](https://discuss.elastic.co/t/monitor-failed-elastic-user-logins/250045/3 "2020-10-24T22:54:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.