Stack access audit

[ksarpong]

I am wondering what's the best way to go about implementing Access logging for individual indexes. Specifically, is there a log that can show which user access information per index or indices?

[Alex_Piggott]

ES has a security audit module, with 2 ways of shipping data:

• (deprecated) over transport protocol ... this should work in ECE for now
• to file ... currently that is shipped to the Logging and Metrics cluster (so you have to ensure the cluster is appropriately sized for the volume) and there is no easy way of separating access to this from other cluster logs

Longer term we are working on being able to ship different log types to different clusters (including external ones)

[ksarpong]

Thanks!