# Using elasticsearch to store audit log information

**URL:** <https://discuss.elastic.co/t/using-elasticsearch-to-store-audit-log-information/16124>\
**Category:** Elasticsearch\
**Created:** [March 3, 2014, 10:34pm UTC](https://discuss.elastic.co/t/using-elasticsearch-to-store-audit-log-information/16124 "2014-03-03T22:34:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![npatil](https://avatars.discourse-cdn.com/v4/letter/n/9f8e36/32.png) [@npatil](https://discuss.elastic.co/u/npatil)\
**Post date:** [March 3, 2014, 10:34pm UTC](https://discuss.elastic.co/t/using-elasticsearch-to-store-audit-log-information/16124/1 "2014-03-03T22:34:26Z")

</div>

Hello,  
I have a use-case wherein I need to capture audit trail style information  
for a large user population (~1 mil) for all their actions within multiple  
applications and across web and API layers.

Questions:

1. From my reading, elasticsearch can be used for this specific use-case.  
(Looks like [github.com](http://github.com) is possibly using them in this manner -  
[http://exploringelasticsearch.com/book/elasticsearch-at-scale-interviews/interview-with-the-github-elasticsearch-team.html](http://exploringelasticsearch.com/book/elasticsearch-at-scale-interviews/interview-with-the-github-elasticsearch-team.html))

2. Will I need to store the audit trail in a separate reliable database in  
addition to elasticsearch or is only using elasticsearch sufficient.

Any tips gratefully appreciated.

Thanks.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/aff233a9-1f5c-44be-bac2-57da770f29ea%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/aff233a9-1f5c-44be-bac2-57da770f29ea%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian/32/1712_2.png) [@Andrew\_Cholakian](https://discuss.elastic.co/u/Andrew_Cholakian)\
**Post date:** [March 3, 2014, 11:52pm UTC](https://discuss.elastic.co/t/using-elasticsearch-to-store-audit-log-information/16124/2 "2014-03-03T23:52:26Z")

</div>

On Monday, March 3, 2014 4:34:26 PM UTC-6, npatil wrote:

> Hello,  
> I have a use-case wherein I need to capture audit trail style information  
> for a large user population (~1 mil) for all their actions within multiple  
> applications and across web and API layers.
> 
> Questions:
> 
> 1. From my reading, elasticsearch can be used for this specific use-case.  
> (Looks like [github.com](http://github.com) is possibly using them in this manner -  
> [http://exploringelasticsearch.com/book/elasticsearch-at-scale-interviews/interview-with-the-github-elasticsearch-team.html](http://exploringelasticsearch.com/book/elasticsearch-at-scale-interviews/interview-with-the-github-elasticsearch-team.html)  
> )

Hi, glad you like my book! Yes, it is indeed used for this case by a number  
of people. I myself am planning on using it with a healthcare client.

> 1. Will I need to store the audit trail in a separate reliable database in  
> addition to elasticsearch or is only using elasticsearch sufficient.

That is a determination you'll need to make yourself. Elasticsearch is  
quite reliable and can be backed up however. This is much easier now with  
the snapshot / restore API. My $0.02 is that it will work fine for this  
case.

Additionally, if you need to move log data to cold storage for cost savings  
at some point, consider time-period based index naming (e.g. logs-2014-02),  
and periodically closing old indexes. You can then move these index files  
to some sort of cold storage if need be.

Let me know if I can help answer your questions in any other way!

> Any tips gratefully appreciated.
> 
> Thanks.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6d320301-7392-4743-b02c-d5f6b9cbcc2a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6d320301-7392-4743-b02c-d5f6b9cbcc2a%40googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:45am UTC](https://discuss.elastic.co/t/using-elasticsearch-to-store-audit-log-information/16124/3 "2017-07-06T01:45:58Z")

</div>