we normally don't use logging. but I turned it on just for the login itself to see what happened. this is the LOCAL login of the kibana user setup in the password-setup binary.
[root@infralogs-elasticsearchm-101w logs]# tail -f stdout
{"type":"response","@timestamp":"2020-10-19T13:24:29Z","tags":[],"pid":23345,"method":"get","statusCode":304,"req":{"url":"/bundles/plugin/file_upload/file_upload.plugin.js","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"e179509f269543fbaa2e576e42c835f9c5f88a0a-/bundles/plugin/file_upload/-gzip\""},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":304,"responseTime":7,"contentLength":9},"message":"GET /bundles/plugin/file_upload/file_upload.plugin.js 304 7ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:29Z","tags":[],"pid":23345,"method":"get","statusCode":304,"req":{"url":"/bundles/plugin/infra/infra.plugin.js","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"b6c2e4783eaa9a76b510fd497a8e6e0501b3ded1-/bundles/plugin/infra/-gzip\""},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":304,"responseTime":5,"contentLength":9},"message":"GET /bundles/plugin/infra/infra.plugin.js 304 5ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:29Z","tags":[],"pid":23345,"method":"get","statusCode":304,"req":{"url":"/bundles/plugin/dataEnhanced/dataEnhanced.plugin.js","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"ed9c2bb1321500d164717e3eabd5e931c8cc6ec8-/bundles/plugin/dataEnhanced/-gzip\""},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":304,"responseTime":8,"contentLength":9},"message":"GET /bundles/plugin/dataEnhanced/dataEnhanced.plugin.js 304 8ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:29Z","tags":[],"pid":23345,"method":"get","statusCode":304,"req":{"url":"/bundles/plugin/navigation/navigation.plugin.js","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"fcf11bd1055dfd87e5e725a466285ef9a0fd83a9-/bundles/plugin/navigation/-gzip\""},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":304,"responseTime":6,"contentLength":9},"message":"GET /bundles/plugin/navigation/navigation.plugin.js 304 6ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:29Z","tags":[],"pid":23345,"method":"get","statusCode":304,"req":{"url":"/bundles/plugin/graph/graph.plugin.js","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"d8690987f63b137c735ed1b9cdd102b92c1fdb2f-/bundles/plugin/graph/-gzip\""},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":304,"responseTime":4,"contentLength":9},"message":"GET /bundles/plugin/graph/graph.plugin.js 304 4ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:29Z","tags":[],"pid":23345,"method":"get","statusCode":304,"req":{"url":"/bundles/plugin/dashboard/dashboard.plugin.js","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"8de2ce3fa04609a3e0ae5e29c7799c523eda36a9-/bundles/plugin/dashboard/-gzip\""},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":304,"responseTime":4,"contentLength":9},"message":"GET /bundles/plugin/dashboard/dashboard.plugin.js 304 4ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:30Z","tags":[],"pid":23345,"method":"post","statusCode":200,"req":{"url":"/api/core/capabilities","method":"post","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","content-length":"364","kbn-version":"7.7.1","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","content-type":"application/json","accept":"*/*","origin":"http://infralogs-prod.active.com:5601","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":200,"responseTime":199,"contentLength":9},"message":"POST /api/core/capabilities 200 199ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:30Z","tags":[],"pid":23345,"method":"get","statusCode":304,"req":{"url":"/bundles/plugin/security/1.plugin.js","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"4b63c3e43c74622206d0e919c24adfa5681a9578-/bundles/plugin/security/-gzip\""},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":304,"responseTime":9,"contentLength":9},"message":"GET /bundles/plugin/security/1.plugin.js 304 9ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:30Z","tags":[],"pid":23345,"method":"get","statusCode":304,"req":{"url":"/bundles/plugin/security/4.plugin.js","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"807814aec6997877c4546bf19815ad8dcdb98352-/bundles/plugin/security/-gzip\""},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":304,"responseTime":9,"contentLength":9},"message":"GET /bundles/plugin/security/4.plugin.js 304 9ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:31Z","tags":[],"pid":23345,"method":"get","statusCode":200,"req":{"url":"/internal/security/login_state","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","kbn-version":"7.7.1","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","content-type":"application/json","accept":"*/*","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":200,"responseTime":16,"contentLength":9},"message":"GET /internal/security/login_state 200 16ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:46Z","tags":[],"pid":23345,"method":"post","statusCode":204,"req":{"url":"/internal/security/login","method":"post","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","content-length":"43","kbn-version":"7.7.1","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","content-type":"application/json","accept":"*/*","origin":"http://infralogs-prod.active.com:5601","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":204,"responseTime":20,"contentLength":9},"message":"POST /internal/security/login 204 20ms - 9.0B"}
{"type":"response","@timestamp":"2020-10-19T13:24:46Z","tags":[],"pid":23345,"method":"get","statusCode":404,"req":{"url":"/app/kibana","method":"get","headers":{"host":"infralogs-prod.active.com:5601","connection":"keep-alive","upgrade-insecure-requests":"1","user-agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"10.220.224.8","userAgent":"10.220.224.8","referer":"http://infralogs-prod.active.com:5601/login?next=%2Fapp%2Fkibana"},"res":{"statusCode":404,"responseTime":98,"contentLength":9},"message":"GET /app/kibana 404