Hi,
I want to check when the index was created, modified or deleted from internal logs(also other details of this particular operation). Is there any way to query this data?
Hi,
Try the below search query,
- the first part will give details regarding action performed on Index (create, edit, remove)
- subquery after join will provide the parameter and other details for the action
index=_audit action=indexes_edit operation IN (create, edit, remove)
| rename object as idx
| bin span=1m _time
| join type=outer _time, idx
[ search index=_internal params=*
| bin span=1m _time
| stats first(params) as params by _time, idx]
| table _time, user, operation, idx, params
accept & up-vote the answer if it helps.
Hi,
Try the below search query,
- the first part will give details regarding action performed on Index (create, edit, remove)
- subquery after join will provide the parameter and other details for the action
index=_audit action=indexes_edit operation IN (create, edit, remove)
| rename object as idx
| bin span=1m _time
| join type=outer _time, idx
[ search index=_internal params=*
| bin span=1m _time
| stats first(params) as params by _time, idx]
| table _time, user, operation, idx, params
accept & up-vote the answer if it helps.