# Unauthorized alert for ES with Open Distro Security

**URL:** <https://discuss.elastic.co/t/unauthorized-alert-for-es-with-open-distro-security/241524>\
**Category:** Elasticsearch\
**Created:** [July 16, 2020, 6:10pm UTC](https://discuss.elastic.co/t/unauthorized-alert-for-es-with-open-distro-security/241524 "2020-07-16T18:10:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![somebody](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@somebody](https://discuss.elastic.co/u/somebody)\
**Post date:** [July 16, 2020, 6:10pm UTC](https://discuss.elastic.co/t/unauthorized-alert-for-es-with-open-distro-security/241524/1 "2020-07-16T18:10:38Z")

</div>

We are using ES (7.6.1 OSS version) with Open Distro ( LDAP security ). We are using Elasticsearch telegraf plugin to get the metrics [Elasticsearch Plugin](https://github.com/influxdata/telegraf/tree/1.10.0/plugins/inputs/elasticsearch)

We know that there is an audit log which we could parse and use input.exec plugin of telegraf to identify unauthorized requests. However, we do not want to write custom code.  
Could you please help us to know if there are any plugins (telegraf) or any other way in which we directly get these unauthorized metrics?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 16, 2020, 7:15pm UTC](https://discuss.elastic.co/t/unauthorized-alert-for-es-with-open-distro-security/241524/2 "2020-07-16T19:15:32Z")

</div>

This question might be more suitable for the OpenDistro forum/community.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 16, 2020, 11:14pm UTC](https://discuss.elastic.co/t/unauthorized-alert-for-es-with-open-distro-security/241524/3 "2020-07-16T23:14:53Z")

</div>

To echo Christian's comment; ODFE is an AWS fork of the original Elasticsearch. We do not maintain or support that sorry to say, and you will need to speak to them about this.

---

<div class="post-metadata">

**Author:** ![somebody](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@somebody](https://discuss.elastic.co/u/somebody)\
**Post date:** [July 20, 2020, 5:23pm UTC](https://discuss.elastic.co/t/unauthorized-alert-for-es-with-open-distro-security/241524/4 "2020-07-20T17:23:39Z")

</div>

@Christian_Dahlqvist Thanks for the reply.

---

<div class="post-metadata">

**Author:** ![somebody](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@somebody](https://discuss.elastic.co/u/somebody)\
**Post date:** [July 20, 2020, 5:24pm UTC](https://discuss.elastic.co/t/unauthorized-alert-for-es-with-open-distro-security/241524/5 "2020-07-20T17:24:02Z")

</div>

@warkolm,  
Thanks for the reply.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2020, 5:24pm UTC](https://discuss.elastic.co/t/unauthorized-alert-for-es-with-open-distro-security/241524/6 "2020-08-17T17:24:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.