# Where to see audit log in OpenSearch Dashboards **URL:** \ **Category:** OpenSearch Dashboards\ **Created:** [November 3, 2023, 10:08am UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543 "2023-11-03T10:08:00Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [November 3, 2023, 10:08am UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543/1 "2023-11-03T10:08:00Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch - 2.11.0 OpenSearch Dashboards - 2.11.0 **Describe the issue** : I have enabled audit log through OpenSerach-Dashbaords after that I have executed few queries through Dev Tools . Please let me know where I can see audit logs in OpenSearch-Dashboards. **Configuration** : 1. In audit.yml file • plugins.security.audit.config.disabled\_rest\_categories: NONE • plugins.security.audit.config.disabled\_transport\_categories: NONE • plugins.security.audit.config.enable\_rest: true • plugins.security.audit.config.enable\_transport: true • plugins.security.audit.config.log\_request\_body: true • plugins.security.audit.config.ignore\_users: NONE • plugins.security.audit.config.resolve\_bulk\_requests: true 1. In opensearch.yml file • plugins.security.audit.type: internal\_opensearch • plugins.security.audit.config.index: “'auditlog-'YYYY.MM.dd” **Relevant Logs or Screenshots** : ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [November 3, 2023, 12:43pm UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543/2 "2023-11-03T12:43:20Z")
@Ashish The audit logs should appear in the `security-auditlog-` index. ---
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [November 6, 2023, 8:08am UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543/3 "2023-11-06T08:08:46Z")
![screenshot for log](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/f/fcb629ee60c4abfe762599db60eded2bb3452914.png) I checked at security-auditlog-\* . I did not get any logs,Please see the attached file ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [November 6, 2023, 8:57am UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543/4 "2023-11-06T08:57:04Z")
@Ashish I’ve just noticed that you’ve changed the index name for the audit logs. According to your output from your other case, the below indices contain the audit logs. > [@Opensearch Audit log issue](https://forum.opensearch.org/t/opensearch-audit-log-issue/16528): > > Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch 2.11.0 Describe the issue: I am using Opensearch 2.11.0 version on RPM machine(Red HAT) . After enabling the audit log and configuring the required audit log setting,I have executed few queries but I am not getting audit logs. Please let me know if anything I am missing. Configuration: I did below audit log configuration for Opensearch application In audit.yml file • plugins.security.audit.config.disabled\_rest\_categ… ```auto yellow open auditlog-2023.10.20 fQhc4-jPQDytQtnS-1GHIw 1 1 1 0 12.7kb 12.7kb yellow open auditlog-2023.11.02 5WZifgOfS1KBWeybUgat4g 1 1 13 0 97.4kb 97.4kb yellow open auditlog-2023.11.03 dh3_2RF4S2er_RBolGUJsw 1 1 4004 0 1.8mb 1.8mb yellow open auditlog-2023.10.27 zrjdJ9G1QqSD5a9ZqnxM_w 1 1 4 0 50.8kb 50.8kb yellow open auditlog-2023.11.06 o2E_hK1HT8udnmcFZnaFaA 1 1 4026 0 2mb 2mb yellow open auditlog-2023.10.26 FmIe2hVpSsWg-nBeylrIcg 1 1 16 0 120.6kb 120.6kb ``` ---
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [November 6, 2023, 9:42am UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543/5 "2023-11-06T09:42:31Z")
ok, but how can I am able to see that logs, Please let me know the location ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [November 6, 2023, 9:47am UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543/6 "2023-11-06T09:47:16Z")
@Ashish You can create an index pattern in the OpenSearch Dashboards and use Discovery to see the raw data. Also, you can use Dashboards and Visualisations to aggregate the data from audit\* indices. ---
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [November 7, 2023, 4:58am UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543/7 "2023-11-07T04:58:59Z")
Yes , I am able to see audit log through Discovery but I am unable to see request body in audit logs for APIs which I have executed, even I have enabled the request body. I have executed below API PUT \_ingest/pipeline/testing-audit { “description”: “This pipeline processes student data”, “processors”: [ { “set”: { “description”: “Sets the graduation year to 2023”, “field”: “grad\_year”, “value”: 2023 } }, { “set”: { “description”: “Sets graduated to true”, “field”: “graduated”, “value”: true } }, { “uppercase”: { “field”: “name” } } ] } For above API got below Audit log { “\_index”: “my-application\_audit-2023.11.06”, “\_id”: “D4HfpIsBrdWEGs1p0Fy6”, “\_version”: 1, “\_score”: null, “\_source”: { “audit\_cluster\_name”: “my-application”, “audit\_rest\_request\_params”: { “pretty”: “true” }, “audit\_node\_name”: “node-1”, “audit\_request\_initiating\_user”: “admin”, “audit\_rest\_request\_method”: “PUT”, “audit\_category”: “AUTHENTICATED”, “audit\_request\_origin”: “REST”, “audit\_node\_id”: “q104YQZ0Rp26UlUHvLwcmA”, “audit\_request\_layer”: “REST”, “audit\_rest\_request\_path”: “/\_ingest/pipeline/testing-audit”, “@timestamp”: “2023-11-06T13:43:33.305+00:00”, “audit\_request\_effective\_user\_is\_admin”: false, “audit\_format\_version”: 4, “audit\_request\_remote\_address”: “13.232.64.37”, “audit\_node\_host\_address”: “172.31.34.60”, “audit\_rest\_request\_headers”: { “content-length”: [ “455” ], “x-forwarded-proto”: [ “http” ], “Connection”: [ “keep-alive” ], “x-forwarded-port”: [ “22969” ], “x-opaque-id”: [ “70365ea9-956c-44b5-bc6b-000ff1f7385d” ], “Host”: [ “3.111.186.221:9500” ], “securitytenant”: [ “ **user** ” ], “x-forwarded-for”: [ “103.214.60.202” ], “authorization”: [ “Basic YWRtaW46YWRtaW4=” ], “x-forwarded-host”: [ “13.232.64.37:5601” ], “x-opensearch-product-origin”: [ “opensearch-dashboards” ], “content-type”: [ “application/json” ], “user-agent”: [ “opensearch-js/2.3.1 (linux 5.14.0-284.30.1.el9\_2.x86\_64-x64; Node.js v18.16.0)” ] }, “audit\_request\_effective\_user”: “admin”, “audit\_node\_host\_name”: “172.31.34.60” }, “fields”: { “@timestamp”: [ “2023-11-06T13:43:33.305Z” ] }, “highlight”: { “audit\_rest\_request\_path”: [ “/@opensearch-dashboards-highlighted-field@\_ingest@/opensearch-dashboards-highlighted-field@/@opensearch-dashboards-highlighted-field@pipeline@/opensearch-dashboards-highlighted-field@/@opensearch-dashboards-highlighted-field@testing@/opensearch-dashboards-highlighted-field@-@opensearch-dashboards-highlighted-field@audit@/opensearch-dashboards-highlighted-field@” ] }, “sort”: [ 1699278213305 ] } ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\ **Post date:** [November 27, 2023, 1:38pm UTC](https://forum.opensearch.org/t/where-to-see-audit-log-in-opensearch-dashboards/16543/8 "2023-11-27T13:38:06Z")
@Ashish I don’t see that either. Did that ever work for you?