how to enable ElasticSearch http access log

Question

I opened couple client nodes with http 9200 to sever ElasticSearch queries/indices. I wanna log the access log from clients via http 9200, just like Http-Apache has the access.log. How should I enable this in ES please.

Val · Accepted Answer · 2016-11-28 11:41:06Z

6

There's no such thing in Elasticsearch itself.

However, if you install the Shield plugin, you can enable auditing by adding this to your elasticsearch.yml configuration file.

shield.audit.enabled: true

You'll then get a new file called elasticsearch-access.log in your ES logs folder.

UPDATE by @lucabelluccini: Shield audit logs to syslog

In case you are interested in forwarding such audit logs to syslog, you can thanks to log4j SyslogAppender class which allows to forward logs to syslog via local socket.

Edit your logging.yml (customize the format etc...)

appender:
  syslog:
    type: org.apache.log4j.net.SyslogAppender
    syslogHost: localhost
    facility: local0
    layout:
      type: org.apache.log4j.PatternLayout
      conversionPattern: "%d{ISO8601} %t %p %c %M %m %n"

Ensure rsyslog configuration allows UDP sources.

Associate this appender to the shield audit topic.

edited Nov 28, 2016 at 11:41

answered Mar 2, 2016 at 4:02

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

how to enable ElasticSearch http access log

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related