# User Account Details **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 26, 2021, 2:03pm UTC](https://discuss.elastic.co/t/user-account-details/279636 "2021-07-26T14:03:16Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![pradeepvj](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@pradeepvj](https://discuss.elastic.co/u/pradeepvj)\ **Post date:** [July 26, 2021, 2:03pm UTC](https://discuss.elastic.co/t/user-account-details/279636/1 "2021-07-26T14:03:16Z")
Hi All, I'm new to ELK...how to we get information about user accounts like user account creation or expiration? something similar to a table in Database I can see \_security/user api has only username,fullname,email and roles. Thanks in Advance. Thanks & Regards, Pradeep ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 26, 2021, 10:28pm UTC](https://discuss.elastic.co/t/user-account-details/279636/2 "2021-07-26T22:28:09Z")
Welcome to our community! 😃 There is a `creation_time` field that is filled out. There is also a `expiration_time` but it is not valid as we don't automatically expire accounts. ---
**Author:** ![pradeepvj](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@pradeepvj](https://discuss.elastic.co/u/pradeepvj)\ **Post date:** [July 27, 2021, 8:28am UTC](https://discuss.elastic.co/t/user-account-details/279636/3 "2021-07-27T08:28:20Z")
where is it available? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 27, 2021, 9:59pm UTC](https://discuss.elastic.co/t/user-account-details/279636/4 "2021-07-27T21:59:41Z")
In the `_source`. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [July 28, 2021, 12:59am UTC](https://discuss.elastic.co/t/user-account-details/279636/5 "2021-07-28T00:59:38Z")
We currently don't record the creation time or update time for users. So there is no way to find them out using APIs. The alternative that I can think of is using [audit logs](https://www.elastic.co/guide/en/elasticsearch/reference/current/enable-audit-logging.html) which can log the exact time when the user creation request is issued. Also as warkolm said, users don't expire. They can be disabled and this status does show in the [GetUser API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-user.html). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 28, 2021, 1:35am UTC](https://discuss.elastic.co/t/user-account-details/279636/6 "2021-07-28T01:35:27Z")
@Yang_Wang what's `creation_time` in each document referencing? ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [July 28, 2021, 3:48am UTC](https://discuss.elastic.co/t/user-account-details/279636/7 "2021-07-28T03:48:07Z")
API Key uses both `creation_time` and `expiration_time`. The security index is shared between different type of documents. Not all fields are used by each of them. That said, in hindsight, we probably would have recorded `creation_time` for user if API Key was introduced earlier. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 25, 2021, 3:48am UTC](https://discuss.elastic.co/t/user-account-details/279636/8 "2021-08-25T03:48:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.