---
title: Security settings in Kibana
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/3174/reference/kibana/configuration-reference/security-settings
products:
  - Kibana
applies_to:
  - Elastic Cloud Hosted: Generally available
  - Self-managed Elastic deployments: Generally available
---

# Security settings in Kibana
You do not need to configure any additional settings to use the security features in Kibana. They are enabled by default.

## Authentication security settings

You configure authentication settings in the `xpack.security.authc` namespace.

For example:
```yaml
xpack.security.authc:
    providers:
      basic.basic1: 
          order: 0 
          ...

      saml.saml1: 
          order: 1
          ...

      saml.saml2: 
          order: 2
          ...

      pki.realm3:
          order: 3
          ...
    ...
```

1. Specifies the type of authentication provider (for example, `basic`, `token`, `saml`, `oidc`, `kerberos`, `pki`) and the provider name. This setting is mandatory.
2. Specifies the order of the provider in the authentication chain and on the Login Selector UI. This setting is mandatory.
3. Specifies the settings for the SAML authentication provider with a `saml1` name.
4. Specifies the settings for the SAML authentication provider with a `saml2` name.

<definitions>
</definitions>

## Valid settings for all authentication providers

The valid settings in the `xpack.security.authc.providers` namespace vary depending on the authentication provider type. For more information, refer to [Authentication](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/user-authentication).
<definitions>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.enabled">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Determines if the authentication provider should be enabled. By default, Kibana enables the provider as soon as you configure any of its properties.
Datatype: `bool`
  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.order">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Order of the provider in the authentication chain and on the Login Selector UI.
Datatype: `int`
  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.description">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Custom description of the provider entry displayed on the Login Selector UI.
Datatype: `string`
  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.hint">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Custom hint for the provider entry displayed on the Login Selector UI.
Datatype: `string`
  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.icon">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Custom icon for the provider entry displayed on the Login Selector UI.
Datatype: `string`
  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.origin">
    <stack-availability>Elastic Stack: Generally available since 9.3</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Specifies the origin(s) where the provider will appear to users in the Login Selector UI. Each origin must be a valid URI only containing an origin. By default, providers are not restricted to specific origins.
Datatype: `string`

For example:
```yaml
xpack.security.authc:
  providers:
    basic.basic1:
      origin: [http://localhost:5601, http://127.0.0.1:5601]
      ...

    saml.saml1:
      origin: https://elastic.co
      ...
```

  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.showInSelector">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Flag that indicates if the provider should have an entry on the Login Selector UI. Setting this to `false` doesn't remove the provider from the authentication chain.
Datatype: `bool`

<note>
  You are unable to set this setting to `false` for `basic` and `token` authentication providers.
</note>

  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.accessAgreement.message">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Access agreement text in Markdown format. For more information, refer to [Access agreement](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/access-agreement).
Datatype: `string`
  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.session.idleTimeout">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Ensures that user sessions will expire after a period of inactivity. Setting this to `0` will prevent sessions from expiring because of inactivity. By default, this setting is equal to [`xpack.security.session.idleTimeout`](#xpack-session-idletimeout).
Datatype: `string`

<note>
  Use a string of `<count>[ms\|s\|m\|h\|d\|w\|M\|Y]` (e.g. *20m*, *24h*, *7d*, *1w*).
</note>

  </definition>
  <definition term="xpack.security.authc.providers.&lt;provider-type&gt;.&lt;provider-name&gt;.session.lifespan">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Ensures that user sessions will expire after the defined time period. This behavior is also known as an "absolute timeout". If this is set to `0`, user sessions could stay active indefinitely. By default, this setting is equal to [`xpack.security.session.lifespan`](#xpack-session-lifespan).
Datatype: `string`

<note>
  Use a string of `<count>[ms\|s\|m\|h\|d\|w\|M\|Y]` (e.g. *20m*, *24h*, *7d*, *1w*).
</note>

  </definition>
</definitions>

## SAML authentication provider settings

In addition to [the settings that are valid for all providers](#authentication-provider-settings), you can specify the following settings:
<definitions>
  <definition term="xpack.security.authc.providers.saml.&lt;provider-name&gt;.realm">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

SAML realm in Elasticsearch that provider should use.
Datatype: `string`
  </definition>
  <definition term="xpack.security.authc.providers.saml.&lt;provider-name&gt;.maxRedirectURLSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Specifies the maximum size of the URL that Kibana is allowed to store during the SAML handshake.
Datatype: `string`
  </definition>
  <definition term="xpack.security.authc.providers.saml.&lt;provider-name&gt;.useRelayStateDeepLink">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Determines if the provider should treat the `RelayState` parameter as a deep link in Kibana during Identity Provider initiated log in. By default, this setting is set to `false`. The link specified in `RelayState` should be a relative, URL-encoded Kibana URL. For example, the `/app/dashboards#/list` link in `RelayState` parameter would look like this: `RelayState=%2Fapp%2Fdashboards%23%2Flist`.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="xpack.security.authc.saml.maxRedirectURLSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Specifies the maximum size of the URL that Kibana is allowed to store during the SAML handshake.
Datatype: `string`
  </definition>
</definitions>

## Discontinued SAML settings

The following settings are available in Elastic Cloud for all supported versions before 8.0:
<definitions>
  <definition term="xpack.security.authProviders">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Elastic Cloud Hosted: Removed</supported-on>

Set to `saml` to instruct Kibana to use SAML SSO as the authentication method.
Datatype: `string`
  </definition>
  <definition term="xpack.security.public.protocol">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Elastic Cloud Hosted: Removed</supported-on>

Set to HTTP or HTTPS. To access Kibana, HTTPS protocol is recommended.
Datatype: `enum`
Options:
- `http`
- `https`
  </definition>
  <definition term="xpack.security.public.hostname">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Elastic Cloud Hosted: Removed</supported-on>

Set to a fully qualified hostname to connect your users to the proxy server.
Datatype: `string`
  </definition>
  <definition term="xpack.security.public.port">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Elastic Cloud Hosted: Removed</supported-on>

The port number that connects your users to the proxy server (for example, 80 for HTTP or 443 for HTTPS).
Datatype: `int`
  </definition>
  <definition term="xpack.security.authc.saml.useRelayStateDeepLink">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Elastic Cloud Hosted: Removed</supported-on>

Specifies if Kibana should treat the `RelayState` parameter as a deep link when Identity Provider Initiated login flow is used.
Datatype: `bool`
  </definition>
  <definition term="server.xsrf.whitelist">
    <stack-availability>Elastic Stack: Unavailable</stack-availability>
    <supported-on>Elastic Cloud Hosted: Removed</supported-on>

Explicitly allows the SAML authentication URL within Kibana, so that the Kibana server doesn't reject external authentication messages that originate from your Identity Provider. This setting is renamed to `server.xsrf.allowlist` in version 8.0.0.
Datatype: `string`
  </definition>
</definitions>

## OpenID Connect authentication provider settings

In addition to [the settings that are valid for all providers](#authentication-provider-settings), you can specify the following settings:
<definitions>
  <definition term="xpack.security.authc.providers.oidc.&lt;provider-name&gt;.realm">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

OpenID Connect realm in Elasticsearch that the provider should use.
Datatype: `string`
  </definition>
</definitions>

## Anonymous authentication provider settings

In addition to [the settings that are valid for all providers](#authentication-provider-settings), you can specify the following settings:
For more information, refer to [Anonymous authentication](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-authentication#anonymous-authentication).

<note>
  You can configure only one anonymous provider per Kibana instance.
</note>

<definitions>
  <definition term="xpack.security.authc.providers.anonymous.&lt;provider-name&gt;.credentials">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Credentials that Kibana should use internally to authenticate anonymous requests to Elasticsearch.
Datatype: `string`

For example:
```yaml
xpack.security.authc.providers.anonymous.anonymous1:
  credentials:
    username: "anonymous_service_account"
    password: "anonymous_service_account_password"
```

  </definition>
</definitions>

## HTTP authentication settings

There is a very limited set of cases when you'd want to change these settings. For more information, refer to [HTTP authentication](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-authentication#http-authentication).
<definitions>
  <definition term="xpack.security.authc.http.enabled">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Determines if HTTP authentication should be enabled. By default, this setting is set to `true`.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="xpack.security.authc.http.autoSchemesEnabled">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Determines if HTTP authentication schemes used by the enabled authentication providers should be automatically supported during HTTP authentication. By default, this setting is set to `true`.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="xpack.security.authc.http.schemes[]">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

List of HTTP authentication schemes that Kibana HTTP authentication should support. By default, this setting is set to `['apikey', 'bearer']` to support HTTP authentication with the [`ApiKey`](https://www.elastic.co/docs/deploy-manage/api-keys/elasticsearch-api-keys) and [`Bearer`](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-authentication#http-authentication) schemes.
Datatype: `string`
Default: `['apikey', 'bearer']`
  </definition>
</definitions>

## Login user interface settings
<definitions>
  <definition term="xpack.security.loginAssistanceMessage">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Adds a message to the login UI. Useful for displaying information about maintenance windows, links to corporate sign up pages, and so on.
Datatype: `string`
  </definition>
  <definition term="xpack.security.loginHelp">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Adds a message accessible at the login UI with additional help information for the login process.
Datatype: `string`
  </definition>
  <definition term="xpack.security.authc.selector.enabled">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Determines if the login selector UI should be enabled. By default, this setting is set to `true` if more than one authentication provider is configured.
Datatype: `bool`
  </definition>
</definitions>

## Configure a default access agreement
<definitions>
  <definition term="xpack.security.accessAgreement.message">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

This setting specifies the access agreement text in Markdown format that will be used as the default access agreement for all providers that do not specify a value for `xpack.security.authc.providers.<provider-type>.<provider-name>.accessAgreement.message`. For more information, refer to [Access agreement](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/access-agreement).
Datatype: `string`
  </definition>
</definitions>

## Session and cookie security settings
<definitions>
  <definition term="xpack.security.cookieName">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Sets the name of the cookie used for the session. The default value is `"sid"`.
Datatype: `string`
Default: `sid`
  </definition>
  <definition term="xpack.security.encryptionKey">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

An arbitrary string of 32 characters or more that is used to encrypt session information. Do **not** expose this key to users of Kibana. By default, a value is automatically generated in memory. If you use that default behavior, all sessions are invalidated when Kibana restarts. In addition, high-availability deployments of Kibana will behave unexpectedly if this setting isn't the same for all instances of Kibana.
Datatype: `string`
  </definition>
  <definition term="xpack.security.secureCookies">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Sets the `secure` flag of the session cookie. The default value is `false`. It is automatically set to `true` if [`server.ssl.enabled`](https://www.elastic.co/docs/reference/kibana/configuration-reference/general-settings#server-ssl-enabled) is set to `true`. Set this to `true` if SSL is configured outside of Kibana (for example, you are routing requests through a load balancer or proxy).
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="xpack.security.sameSiteCookies">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sets the `SameSite` attribute of the session cookie. This allows you to declare whether your cookie should be restricted to a first-party or same-site context. Valid values are `Strict`, `Lax`, `None`. This is **not set** by default, which modern browsers will treat as `Lax`. If you use Kibana embedded in an iframe in modern browsers, you might need to set it to `None`. Setting this value to `None` requires cookies to be sent over a secure connection by setting [`xpack.security.secureCookies`](#xpack-security-securecookies): `true`.
Datatype: `enum`
Options:
- `Strict`
- `Lax`
- `None`
  </definition>
  <definition term="xpack.security.session.idleTimeout">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Ensures that user sessions will expire after a period of inactivity. This and [`xpack.security.session.lifespan`](#xpack-session-lifespan) are both highly recommended. You can also specify this setting for [every provider separately](#xpack-security-provider-session-idletimeout). If this is set to `0`, then sessions will never expire due to inactivity. By default, this value is 3 days.
Datatype: `string`
Default: `3d`

<note>
  Use a string of `<count>[ms\|s\|m\|h\|d\|w\|M\|Y]` (e.g. *20m*, *24h*, *7d*, *1w*).
</note>

  </definition>
  <definition term="xpack.security.session.lifespan">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Ensures that user sessions will expire after the defined time period. This behavior is also known as an "absolute timeout". If this is set to `0`, user sessions could stay active indefinitely. This and [`xpack.security.session.idleTimeout`](#xpack-session-idletimeout) are both highly recommended. You can also specify this setting for [every provider separately](#xpack-security-provider-session-lifespan). By default, this value is 30 days for on-prem installations, and 24 hours for Elastic Cloud installations.
Datatype: `string`
Default: `30d (on-prem), 24h (Elastic Cloud)`

<tip>
  Use a string of `<count>[ms\|s\|m\|h\|d\|w\|M\|Y]` (e.g. *20m*, *24h*, *7d*, *1w*).
</tip>

  </definition>
  <definition term="xpack.security.session.cleanupInterval">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sets the interval at which Kibana tries to remove expired and invalid sessions from the session index. By default, this value is 1 hour. The minimum value is 10 seconds.
Datatype: `string`
Default: `1h`

<tip>
  Use a string of `<count>[ms\|s\|m\|h\|d\|w\|M\|Y]` (e.g. *20m*, *24h*, *7d*, *1w*).
</tip>

  </definition>
  <definition term="xpack.security.session.concurrentSessions.maxSessions">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set the maximum number of sessions each user is allowed to have active at any given time. By default, no limit is applied. If set, the value of this option should be an integer between `1` and `1000`. When the limit is exceeded, the oldest session is automatically invalidated.
It is available in Elastic Cloud 8.7.0 and later versions.
Datatype: `int`
  </definition>
</definitions>

## Encrypted saved objects settings

These settings control the encryption of saved objects with sensitive data. For more details, refer to [Secure saved objects](https://www.elastic.co/docs/deploy-manage/security/secure-saved-objects).
<definitions>
  <definition term="xpack.encryptedSavedObjects.encryptionKey">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

An arbitrary string of at least 32 characters that is used to encrypt sensitive properties of saved objects before they're stored in Elasticsearch. If not set, Kibana will generate a random key on startup, but certain features won't be available until you set the encryption key explicitly.
Datatype: `string`
  </definition>
  <definition term="xpack.encryptedSavedObjects.keyRotation.decryptionOnlyKeys">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

An optional list of previously used encryption keys. Like [`xpack.encryptedSavedObjects.encryptionKey`](#xpack-encryptedsavedobjects-encryptionkey), these must be at least 32 characters in length. Kibana doesn't use these keys for encryption, but may still require them to decrypt some existing saved objects. Use this setting if you wish to change your encryption key, but don't want to lose access to saved objects that were previously encrypted with a different key.
Datatype: `string`
  </definition>
</definitions>

## Audit logging settings

You can enable audit logging to support compliance, accountability, and security. When enabled, Kibana will capture:
- Who performed an action
- What action was performed
- When the action occurred

For more details and a reference of audit events, refer to [Audit logs](https://www.elastic.co/docs/reference/kibana/kibana-audit-events).
<definitions>
  <definition term="xpack.security.audit.enabled">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set to `true` to enable audit logging. **Default:** `false`
Datatype: `bool`
Default: `false`

For example:
```yaml
xpack.security.audit.enabled: true
xpack.security.audit.appender: 
  type: rolling-file
  fileName: ./logs/audit.log
  policy:
    type: time-interval
    interval: 24h 
  strategy:
    type: numeric
    max: 10 
  layout:
    type: json
```

1. This appender is the default and will be used if no `appender.*` config options are specified.
2. Rotates log files every 24 hours.
3. Keeps maximum of 10 log files before deleting older ones.

  </definition>
  <definition term="xpack.security.audit.appender">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Specifies where audit logs should be written to and how they should be formatted. If no appender is specified, a default appender will be used (see above).
Datatype: `string`
  </definition>
  <definition term="xpack.security.audit.appender.type">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Required. Specifies where audit logs should be written to. Allowed values are `console`, `file`, or `rolling-file`.
Refer to [file appender](#audit-logging-file-appender) and [rolling file appender](#audit-logging-rolling-file-appender) for appender specific settings.
Datatype: `enum`
Options:
- `console`
- `file`
- `rolling-file`
  </definition>
  <definition term="xpack.security.audit.appender.layout.type">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Specifies how audit logs should be formatted. Allowed values are `json` or `pattern`.
Refer to [pattern layout](#audit-logging-pattern-layout) for layout specific settings.
Datatype: `enum`
Options:
- `json`
- `pattern`

<tip>
  We recommend using `json` format to allow ingesting Kibana audit logs into Elasticsearch using Filebeat.
</tip>

  </definition>
</definitions>

## File appender

The `file` appender writes to a file and can be configured using the following settings:
<definitions>
  <definition term="xpack.security.audit.appender.fileName">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Full file path the log file should be written to.
Datatype: `string`
  </definition>
</definitions>

## Rolling file appender

The `rolling-file` appender writes to a file and rotates it using a rolling strategy, when a particular policy is triggered:
<definitions>
  <definition term="xpack.security.audit.appender.fileName">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Full file path the log file should be written to.
Datatype: `string`
  </definition>
  <definition term="xpack.security.audit.appender.policy.type">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Specifies when a rollover should occur. Allowed values are `size-limit` and `time-interval`. **Default:** `time-interval`.
Refer to [size limit policy](#audit-logging-size-limit-policy) and [time interval policy](#audit-logging-time-interval-policy) for policy specific settings.
Datatype: `enum`
Default: `time-interval`
Options:
- `size-limit`
- `time-interval`
  </definition>
  <definition term="xpack.security.audit.appender.strategy.type">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Specifies how the rollover should occur. Only allowed value is currently `numeric`. **Default:** `numeric`
Refer to [numeric strategy](#audit-logging-numeric-strategy) for strategy specific settings.
Datatype: `enum`
Default: `numeric`
Options:
- `numeric`
  </definition>
</definitions>

## Size limit triggering policy

The `size-limit` triggering policy will rotate the file when it reaches a certain size:
<definitions>
  <definition term="xpack.security.audit.appender.policy.size">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Maximum size the log file should reach before a rollover should be performed. **Default:** `100mb`
Datatype: `string`
Default: `100mb`
  </definition>
</definitions>

## Time interval triggering policy

The `time-interval` triggering policy will rotate the file every given interval of time:
<definitions>
  <definition term="xpack.security.audit.appender.policy.interval">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

How often a rollover should occur. **Default:** `24h`
Datatype: `string`
Default: `24h`
  </definition>
  <definition term="xpack.security.audit.appender.policy.modulate">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Whether the interval should be adjusted to cause the next rollover to occur on the interval boundary. **Default:** `true`
Datatype: `bool`
Default: `true`
  </definition>
</definitions>

## Numeric rolling strategy

The `numeric` rolling strategy will suffix the log file with a given pattern when rolling over, and will retain a fixed number of rolled files:
<definitions>
  <definition term="xpack.security.audit.appender.strategy.pattern">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Suffix to append to the file name when rolling over. Must include `%i`. **Default:** `-%i`
Datatype: `string`
Default: `-%i`
  </definition>
  <definition term="xpack.security.audit.appender.strategy.max">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Maximum number of files to keep. Once this number is reached, oldest files will be deleted. **Default:** `7`
Datatype: `int`
Default: `7`
  </definition>
</definitions>

## Pattern layout

The `pattern` layout outputs a string, formatted using a pattern with special placeholders, which will be replaced with data from the actual log message:
<definitions>
  <definition term="xpack.security.audit.appender.layout.pattern">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Specifies how the log line should be formatted. **Default:** `[%date][%level][%logger]%meta %message`
Datatype: `string`
Default: `[%date][%level][%logger]%meta %message`
  </definition>
  <definition term="xpack.security.audit.appender.layout.highlight">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Set to `true` to enable highlighting log messages with colors.
Datatype: `bool`
  </definition>
</definitions>

## Ignore filters
<definitions>
  <definition term="xpack.security.audit.ignore_filters[]">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of filters that determine which events should be excluded from the audit log. An event will get filtered out if at least one of the provided filters matches.
Datatype: `string`

For example:
```yaml
xpack.security.audit.ignore_filters:
- actions: [http_request] 
- categories: [database]
  types: [creation, change, deletion] 
- spaces: [default] 
- users: [elastic, kibana_system] 
```

1. Filters out HTTP request events
2. Filters out any data write events
3. Filters out events from the `default` space
4. Filters out events from the `elastic` and `kibana_system` users

  </definition>
  <definition term="xpack.security.audit.ignore_filters[].actions[]">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of values matched against the `event.action` field of an audit event. Refer to [Audit logs](https://www.elastic.co/docs/reference/kibana/kibana-audit-events) for a list of available events.
Datatype: `string`
  </definition>
  <definition term="xpack.security.audit.ignore_filters[].categories[]">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of values matched against the `event.category` field of an audit event. Refer to [ECS categorization field](https://www.elastic.co/docs/reference/ecs-allowed-values-event-category) for allowed values.
Datatype: `string`
  </definition>
  <definition term="xpack.security.audit.ignore_filters[].outcomes[]">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of values matched against the `event.outcome` field of an audit event. Refer to [ECS outcome field](https://www.elastic.co/docs/reference/ecs-allowed-values-event-outcome) for allowed values.
Datatype: `string`
  </definition>
  <definition term="xpack.security.audit.ignore_filters[].spaces[]">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of values matched against the `kibana.space_id` field of an audit event. This represents the space id in which the event took place.
Datatype: `string`
  </definition>
  <definition term="xpack.security.audit.ignore_filters[].types[]">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of values matched against the `event.type` field of an audit event. Refer to [ECS type field](https://www.elastic.co/docs/reference/ecs-allowed-values-event-type) for allowed values.
Datatype: `string`
  </definition>
  <definition term="xpack.security.audit.ignore_filters[].users[]">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of values matched against the `user.name` field of an audit event. This represents the `username` associated with the audit event.
Datatype: `string`
  </definition>
</definitions>