Enable and configure Kibana audit logging for saved object access, logins, and space operations. Use when setting up Kibana audit, filtering events, or correlating Kibana and ES audit logs.
---
name: kibana-audit
description: >
Enable and configure Kibana audit logging for saved object access, logins, and space
operations. Use when setting up Kibana audit, filtering events, or correlating Kibana
and ES audit logs.
metadata:
author: elastic
version: 0.1.0
---
# Kibana Audit Logging
Enable and configure audit logging for Kibana via `kibana.yml`. Kibana audit logs cover application-layer security
events that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases),
login/logout, session expiry, space operations, and Kibana-level RBAC enforcement.
For Elasticsearch audit logging (authentication failures, access grants/denials, security config changes), see
**elasticsearch-audit**. For authentication and API key management, see **elasticsearch-authn**. For roles and user
management, see **elasticsearch-authz**.
For detailed event types, schema, and correlation queries, see
[references/api-reference.md](references/api-reference.md).
> **Deployment note:** Kibana audit configuration differs across deployment types. See… install to load the full skillIn any Claude conversation, say:
Install the Kibana Audit skill
It activates automatically in your next session.
Not connected yet? Connect your AI first →
MCP endpoint
https://skillme.dev/api/mcp