Help Center/ Cloud Search Service/ User Guide/ Elasticsearch/ Viewing Elasticsearch Cluster Audit Logs
Updated on 2026-01-09 GMT+08:00

Viewing Elasticsearch Cluster Audit Logs

To ensure data security and compliance, enterprises must routinely record and audit operations performed on their cloud service resources. With Cloud Trace Service (CTS), you can record operations associated with CSS Elasticsearch clusters for later query, auditing, and backtracking.

Prerequisites

CTS has been enabled.

Key Operations That Can Be Audited Using CTS

Table 1 Key operations that can be audited using CTS

Operation

Resource Type

Event Name

Querying product dynamics on the Overview page

cluster

listByGraph

Querying cluster and disk information on the Dashboards page

cluster

showDashboard

Querying supported engine types

cluster

listDatastores

Querying flavors supported by a specified engine type

cluster

getSingleDatabaseFlavors

Querying supported AZs

user

getAZInfo

Querying available disk types

cluster

listDiskTypes

Obtaining the node flavor list

cluster

listFlavors

Querying details about a specified flavor

cluster

showFlavorDetail

Querying feature availability

user

showFunctionSwitch

Querying available resource quotas

user

queryQuota

Creating a cluster

cluster

createCluster

Querying the cluster list

cluster

listClusters

Querying cluster details

cluster

showClusterDetail

Querying the storage capacity of a cluster

cluster

getClusterDiskInfos

Performing authentication for a yearly/monthly cluster and obtaining allowed operations

cluster

serviceAuthentication

Changing the billing mode of a cluster from pay-per-use to yearly/monthly

cluster

updateOndemandClusterToPeriod

Querying the price of a yearly/monthly subscription when switching from pay-per-use

cluster

onDemandToPeriodInquiry

Updating resource status

cluster

updateServiceStatus

Updating resource metadata

cluster

updateServiceMetadata

Changing the cluster name

cluster

updateClusterName

Modifying the cluster description

cluster

updateClusterDesc

Deleting a failed snapshot task

cluster

deleteFailedTaskByTaskId

Deleting all failed snapshot tasks

cluster

deleteAllFailedTask

Querying all failed snapshot tasks

cluster

listAllFailedTasks

Clearing the status of a specified task for a cluster

cluster

clearClusterAction

Quickly restarting a cluster

cluster

restartCluster

Performing a rolling restart on a cluster

cluster

rollingRestart

Deleting a cluster

cluster

deleteCluster

Creating a cluster (V2)

cluster

createClusterV2

Querying the cluster list

cluster

listClustersDetails

Querying the cluster list (V2)

cluster

listClustersDetailsV2

Changing the security group

cluster

changeSecurityGroup

Changing the password of a cluster

cluster

resetPassword

Downloading a security certificate

cluster

downloadCert

Changing the subnet of a cluster

cluster

changeClusterSubnet

Obtaining a cluster route

cluster

getRoutes

Updating cluster routes

cluster

updateRoute

Obtaining private network access control policies

cluster

getAccessPolicy

Modifying private network access control policies

cluster

updateAccessPolicy

Adding data nodes to a cluster

cluster

updateExtendCluster

Adding more nodes and storage capacity

cluster

updateExtendInstanceStorage

Changing the specifications of data nodes in a cluster

cluster

updateFlavor

Changing the flavor of a specified node type

cluster

updateFlavorByType

Querying available flavors

cluster

queryResizeFlavors

Removing specified nodes

cluster

updateShrinkNodes

Removing nodes of a specific type

cluster

updateShrinkCluster

Querying information about nodes to be deleted

cluster

queryNeedDeleteInstances

Changing the security mode

cluster

changeMode

Querying the system indexes of a security-mode cluster

cluster

getSecurityIndex

Adding new node types

cluster

addIndependentNode

Enabling master nodes

cluster

addIndependentMasterNode

Enabling client nodes

cluster

addIndependentClientNode

Enabling cold data nodes

cluster

addIndependentColdNode

Replacing a specified node

cluster

updateInstance

Changing AZs for cluster nodes

cluster

updateAzByInstanceType

Upgrading the cluster kernel

cluster

upgradeCore

Obtaining information about the target image to upgrade to

cluster

listImages

Obtaining upgrade details

cluster

upgradeDetail

Retrying a failed kernel upgrade or AZ change task

cluster

retryAction

Terminating a failed kernel upgrade or AZ change task

cluster

abortAction

Querying all tags

cluster

listClustersTags

Querying the tags of a specified cluster

cluster

showClusterTag

Adding tags for a cluster

cluster

createClustersTags

Deleting the tags of a cluster

cluster

deleteClustersTags

Adding or deleting cluster tags in batches

cluster

updateBatchClustersTags

Loading a custom word dictionary

cluster

createLoadIkThesaurus

Viewing custom word dictionary configurations

cluster

showIkThesaurus

Deleting a custom word dictionary

cluster

deleteIkThesaurus

Enabling or disabling public network access

cluster

bindOrUnbindPublicIp

Enabling public network access

cluster

createBindPublic

Disabling public network access

cluster

updateUnbindPublic

Modifying public network bandwidth

cluster

updatePublicBandWidth

Enabling the public network access control whitelist

cluster

startPublicWhitelist

Disabling the public network access control whitelist

cluster

stopPublicWhitelist

Enabling public network access to Kibana

cluster

startKibanaPublic

Disabling public network access to Kibana

cluster

updateCloseKibana

Modifying the public network bandwidth for Kibana

cluster

updateAlterKibana

Modifying public network access control for Kibana

cluster

updatePublicKibanaWhitelist

Disabling public network access control for Kibana

cluster

stopPublicKibanaWhitelist

Modifying the public network bandwidth for the cluster or Kibana

cluster

updateBandWidth

Modifying the public network access control whitelist for the cluster or Kibana

cluster

updateWhitelist

Querying the public network or Kibana public network to be unbound

cluster

queryNeedDeleteBandwidth

Enabling logging

cluster

startLogs

Disabling logging

cluster

stopLogs

Querying the log backup task list

cluster

listLogsJob

Querying basic log configurations

cluster

showGetLogSetting

Modifying basic log configurations

cluster

updateLogSetting

Enabling automatic log backup

cluster

startLogAutoBackupPolicy

Disabling automatic log backup

cluster

stopLogAutoBackupPolicy

Backing up logs

cluster

createLogBackup

Querying logs

cluster

showLogBackup

Checking the network connectivity between the current cluster and the destination cluster

cluster

detectClusterConnectivity

Automatically configuring basic cluster snapshot settings

cluster

startAutoSetting

Configuring basic cluster snapshot settings

cluster

openSnapshotFunction

Modifying the basic settings of a cluster snapshot

cluster

updateSnapshotSetting

Manually creating a snapshot

snapshot

createSnapshot

Restoring a snapshot

snapshot

restoreSnapshot

Deleting a specified snapshot

snapshot

deleteSnapshot

Setting an automatic snapshot creation policy

cluster

createAutoCreatePolicy

Querying cluster snapshot policies

cluster

queryClustersBackupPolicy

Querying automatic snapshot creation policies

cluster

showAutoCreatePolicy

Querying the cluster snapshot list

cluster

listSnapshots

Querying the cluster snapshot list

cluster

listClusterBackups

Disabling snapshots

cluster

stopSnapshot

Enabling automatic snapshot creation

cluster

startAutoCreateSnapshots

Disabling automatic snapshot creation

cluster

stopAutoCreateSnapshots

Querying the destination cluster for snapshot restoration

cluster

queryTargetRestoreCluster

Enabling or disabling VPC Endpoint

cluster

bindOrUnbindEIP

Enabling VPC Endpoint

cluster

startVpecp

Disabling VPC Endpoint

cluster

stopVpecp

Obtaining a VPCEP connection

cluster

showVpcepConnection

Updating a VPCEP connection

cluster

updateVpcepConnection

Modifying the VPCEP whitelist

cluster

updateVpcepWhitelist

Obtaining the parameter settings list

cluster

listYmls

Obtaining the parameter settings task list

cluster

listYmlsJob

Modifying parameter settings

cluster

updateYmls

Querying dedicated load balancers supported by a cluster

cluster

listElbs

Enabling or disabling a cluster load balancer

cluster

enableOrDisableElb

Configuring a cluster load balancer listener

cluster

createElbListener

Updating load balancer listeners for a cluster

cluster

updateEsListener

Obtaining information about a cluster's load balancers

cluster

showElbDetail

Querying certificates supported by a load balancer

cluster

listElbCerts

Querying historical reports and details for intelligent diagnostics

cluster

listAiOps

Creating an intelligent diagnostics task

cluster

createAiOps

Deleting an intelligent diagnostics task

cluster

deleteAiOps

Obtaining SMN topics available for intelligent O&M alarms

cluster

listSmnTopics

Updating the scheduled diagnostics configuration for intelligent O&M

cluster

updateAiOpsSetting

Disabling scheduled diagnostics for intelligent O&M

cluster

closeAiOpsSetting

Viewing the scheduled diagnostics configuration for intelligent O&M

cluster

showAiOpsSetting

Viewing intelligent O&M diagnostics items

cluster

showAiOpsDetector

Querying default plug-ins

cluster

getDefaultPlugins

Creating an agency

user

createAgency

Querying the agency list

cluster

listAgencies

Querying available OBS buckets

user

getAvailableBuckets

Querying files in a specified OBS bucket

cluster

listObjects

Querying resources by tag

cluster

getResourceByTags

Querying Real-Time Traces

After a management tracker is created on the CTS console, the system starts recording operations performed on cloud service resources. After a data tracker is created, the system starts recording operations performed on data in OBS buckets. CTS retains operation records generated in the latest seven days.

To view or export operation records of the last seven days on the CTS console, see Querying Real-Time Traces.