# elasticsearch-audit

> Claude/Codex skill by [@elastic](https://omgskills.com/library/elastic/index.md) · 544 stars · Updated 2026-07-22

Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.

## Install

```sh
git clone https://github.com/elastic/agent-skills /tmp/agent-skills && ln -s /tmp/agent-skills/skills/elasticsearch/elasticsearch-audit ~/.claude/skills/elasticsearch-audit
```

## From README

Elasticsearch Audit Logging Enable and configure security audit logging for Elasticsearch via the cluster settings API. Audit logs record security events such as authentication attempts, access grants and denials, role changes, and API key operations — essential for compliance and incident investigation. For Kibana audit logging (saved object access, login/logout, space operations), see kibana-audit. For authentication and API key management, see elasticsearch-authn. For roles and user management, see elasticsearch-authz. For diagnosing security errors, see elasticsearch-security-troubleshooting. For detailed API endpoints and event types, see references/api-reference.md. Deployment note: Audit logging configuration differs across deployment types. See Deployment Compatibility for details.

## Links

- HTML page: https://omgskills.com/skills/elastic/agent-skills/elasticsearch-audit/
- GitHub: https://github.com/elastic/agent-skills
- Author: [@elastic](https://omgskills.com/library/elastic/index.md)

## More from this repo

- [elasticsearch-authn](https://omgskills.com/skills/elastic/agent-skills/elasticsearch-authn/index.md) — Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms.
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 459 stars
- [elasticsearch-authz](https://omgskills.com/skills/elastic/agent-skills/elasticsearch-authz/index.md) — Used to manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security.
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 459 stars
- [elasticsearch-esql](https://omgskills.com/skills/elastic/agent-skills/elasticsearch-esql/index.md) — Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze...
   - [@elastic](https://omgskills.com/library/elastic/index.md) · 459 stars