0Pricing
Elasticsearch & Full Text Search Systems · Lesson

API Keys and Audit Logging

Secure programmatic access with scoped API keys instead of passwords, and prove who did what by enabling and reading the Elasticsearch audit log.

API Keys and Audit Logging is a free Elasticsearch & Full Text Search Systems lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Elasticsearch & Full Text Search Systems learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Beyond Passwords

Applications should not authenticate with a human's username and password. Elasticsearch provides API keys: scoped, revocable credentials ideal for services. Pair them with audit logging to track every security-relevant action.

What Is an API Key

An API key is a credential tied to a set of permissions, with an optional expiration. It can be limited to a subset of the creating user's privileges, following the principle of least privilege.

Creating a Key

Use the create API key endpoint. The response includes an id and api_key value shown only once, so store it securely.

POST /_security/api_key
{
  "name": "logging-app",
  "expiration": "30d"
}

Restricting a Key

Attach role_descriptors to limit what the key can do, even if the creating user has more power. Here the key may only read one index.

POST /_security/api_key
{
  "name": "reader",
  "role_descriptors": {
    "ro": {
      "indices": [{ "names": ["logs-*"], "privileges": ["read"] }]
    }
  }
}

Using a Key

Send the base64-encoded id:api_key pair in the Authorization header with the ApiKey scheme.

GET /logs-2024/_search
Authorization: ApiKey VnVhQ2ZHY0JDZGJrU...

Revoking Keys

Compromised or retired keys are invalidated immediately, without changing any user's password. You can revoke by id, by name, or all keys owned by a user.

DELETE /_security/api_key
{
  "name": "logging-app"
}

Why Audit Logging

Audit logs answer the compliance question: who did what, when, and from where. They record authentication attempts, access grants and denials, and configuration changes.

Enabling the Audit Log

Audit logging is turned on in elasticsearch.yml. It is disabled by default because it generates significant volume.

xpack.security.audit.enabled: true

Filtering Events

Tune which events are captured with include/exclude lists to avoid drowning in noise. Common choices keep access_denied and authentication_failed while dropping routine reads.

xpack.security.audit.logfile.events.exclude: [ access_granted ]

Reading Audit Output

Audit events are written as structured JSON to a dedicated log file. Each line includes the event type, user, client IP, request path, and outcome, making it easy to ship into Kibana for analysis.

Best Practices

Rotate API keys regularly, scope them tightly, store the audit log on durable storage separate from the cluster, and alert on repeated authentication_failed events that may signal an attack.

Quick Check

Test your understanding of API keys.

Recap

You learned to secure access and accountability:

  • API keys are scoped, expiring, revocable credentials for applications.
  • Use role_descriptors to enforce least privilege.
  • Audit logging records who did what, when, and from where.
  • Filter audit events to manage volume and alert on failed authentications.

Frequently asked questions

Is the “API Keys and Audit Logging” lesson free?

Yes — the full text of “API Keys and Audit Logging” is free to read here on the web, and the Elasticsearch & Full Text Search Systems course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Elasticsearch & Full Text Search Systems course, upgrade to CoddyKit PRO.

What will I learn in “API Keys and Audit Logging”?

Secure programmatic access with scoped API keys instead of passwords, and prove who did what by enabling and reading the Elasticsearch audit log. You practise Elasticsearch & Full Text Search Systems with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Elasticsearch & Full Text Search Systems?

No prior experience is required. Elasticsearch & Full Text Search Systems on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “API Keys and Audit Logging” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Elasticsearch & Full Text Search Systems lesson?

Yes. Every Elasticsearch & Full Text Search Systems lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. User Authentication and Roles
  2. Field and Document Level Security
  3. TLS/SSL and Network Security
  4. API Keys and Audit Logging
← Back to Elasticsearch & Full Text Search Systems