Alibaba Cloud Elasticsearch is integrated with ActionTrail. In the ActionTrail console, you can query user-initiated events that are generated when operations are performed on Alibaba Cloud Elasticsearch. ActionTrail can deliver user-initiated events to Logstores in Log Service or Object Storage Service (OSS) buckets. This way, you can audit the events in real time and locate the causes for issues.

ActionTrail generates user-initiated events when operations are performed on cloud resources by using APIs or the consoles of Alibaba Cloud services. The following table describes the user-initiated events for Alibaba Cloud Elasticsearch that you can query in the ActionTrail console.

Event Description
ActivateZones Restores the nodes in a disabled zone for an Elasticsearch cluster.
AddConnectableCluster Establish a network connection between two Elasticsearch clusters.
AddSnapshotRepo Creates a shared OSS repository for an Elasticsearch cluster.
CancelDeletion Disables release protection for an Elasticsearch cluster.
CancelLogstashDeletion Disables release protection for a Logstash cluster.
CancelTask Cancels a data migration task of an Elasticsearch cluster.
CloseDiagnosis Disables intelligent O&M for an Elasticsearch cluster.
CloseHttps Disables HTTPS for an Elasticsearch cluster.
CreateCollector Creates a Beats shipper.
createInstance Creates an Elasticsearch cluster.
CreateLogstash Creates a Logstash cluster.
CreatePipelines Creates a pipeline in a Logstash cluster.
CreateSnapshot Creates manual snapshots for an Elasticsearch cluster.
CreateVpcEndpoint Creates an endpoint in the virtual private cloud (VPC) within the Elasticsearch service account.
DeactivateZones Disables one or more zones where a multi-zone Elasticsearch cluster resides and migrates the nodes in the disabled zones to other zones.
DeleteCollector Deletes a Beats shipper.
DeleteConnectedCluster Disconnects an Elasticsearch cluster from another Elasticsearch cluster.
DeleteDataTask Deletes a data migration task of an Elasticsearch cluster.
DeleteInstance Releases a pay-as-you-go Elasticsearch cluster.
DeleteLogstash Releases a pay-as-you-go Logstash cluster.
DeletePipelines Deletes a specified pipeline in a Logstash cluster.
DeleteSnapshotRepo Deletes a shared OSS repository for an Elasticsearch cluster.
DeleteVpcEndpoint Deletes an endpoint in the VPC within the Elasticsearch service account.
DescribeAckOperator Queries the information of ES-operator that is installed for a specified Container Service for Kubernetes (ACK) cluster.
DescribeCollector Queries the details of a Beats shipper.
DescribeConnectableClusters Queries the Elasticsearch clusters that can be connected to the current Elasticsearch cluster.
DescribeDynamicSettings Queries the dynamic settings of an Elasticsearch cluster.
DescribeElasticsearchHealth Queries the health status of an Elasticsearch cluster.
DescribeInstance Queries the details about an Elasticsearch cluster, such as cluster configurations and network configurations.
DescribeKibanaSettings Queries the settings configuration of the Kibana node in an Elasticsearch cluster.
DescribeLogstash Queries the details about a specified Logstash cluster.
DescribePipeline Queries the details about a pipeline in a Logstash cluster.
DescribePipelineManagementConfig Queries the management configuration of pipelines in a Logstash cluster.
DescribeRegions Queries the regions where Elasticsearch is available.
DescribeSnapshotSetting Queries the data backup configurations of an Elasticsearch cluster.
DescribeXpackMonitorConfig Queries the configuration of the X-Pack Monitoring feature of a Logstash cluster.
EstimatedLogstashRestartTime Queries the estimated time that is required to restart a Logstash cluster.
EstimatedRestartTime Queries the estimated time that is required to restart an Elasticsearch cluster.
GetClusterDataInformation Queries the metadata information of an Elasticsearch cluster.
GetElastictask Queries auto scaling rules configured for an Elasticsearch cluster.
GetSuggestShrinkableNodes Queries nodes that can be removed from an Elasticsearch cluster.
GetTransferableNodes Queries nodes from which data can be migrated in an Elasticsearch cluster.
InitializeOperationRole Creates a service-linked role.
InstallAckOperator Installs Elasticsearch-operator for an ACK cluster when you install a Beats shipper on the ACK cluster.
InstallKibanaSystemPlugin Installs a built-in plug-in for Kibana.
InstallLogstashSystemPlugin Installs a built-in plug-in for a Logstash cluster.
InstallSystemPlugin Installs a built-in plug-in for an Elasticsearch cluster.
InstallUserPlugins Installs a custom plug-in for an Elasticsearch cluster.
InterruptElasticsearchTask Suspends a change task of an Elasticsearch cluster.
InterruptLogstashTask Suspends a change task of a Logstash cluster.
ListAckClusters Queries all available ACK clusters when you install a Beats shipper on an ACK cluster.
ListAckNamespaces Queries namespaces in an ACK cluster when you install a Beats shipper on the ACK cluster.
ListAllNode Queries the information about all nodes in an Elasticsearch cluster.
ListAlternativeSnapshotRepos Queries the shared OSS repositories that can be configured for an Elasticsearch cluster.
ListAvailableEsInstanceIds Queries the Elasticsearch clusters that can be associated with a Logstash cluster when you configure the X-Pack Monitoring feature for the Logstash cluster.
ListCollectors Queries Beats shippers.
ListConnectedClusters Queries the Elasticsearch clusters that are connected to the current Elasticsearch cluster.
ListDataTasks Queries data migration tasks of an Elasticsearch cluster.
ListDefaultCollectorConfigurations Queries the initial default settings of a Beats shipper.
ListDictInformation Queries and verifies the details of the dictionary object stored in Object Storage Service (OSS) when you upload the object to an Elasticsearch cluster.
ListDicts Queries the details of a specified type of dictionary and the link that is generated based on the related signature to download the dictionary.
ListEcsInstances Queries all available Elastic Compute Service (ECS) instances when you install a Beats shipper on an ECS instance.
ListExtendfiles Queries the third-party libraries of a Logstash cluster.
ListInstanceHistoryEvents Queries events for hardware O&M triggered by an Elasticsearch cluster.
ListInstanceIndices Queries indexes in an Elasticsearch cluster.
ListKibanaPlugins Queries Kibana plug-ins.
ListLogstash Queries the details of all or specific Logstash clusters.
ListLogstashLog Queries the logs of a Logstash cluster.
ListLogstashPlugins Queries the details of all or specific Logstash plug-ins.
ListNodes Queries the statuses of ECS instances on which a Beats shipper is installed.
ListPipeline Queries the pipelines of a Logstash cluster.
ListPipelineIds Queries the IDs of pipelines in a Logstash cluster.
ListPlugins Queries the plug-ins that are installed on a specified Elasticsearch cluster.
ListSearchLog Queries the logs of an Elasticsearch cluster.
ListShardRecoveries Queries the information of shards that are being restored or shards that are restored in an Elasticsearch cluster.
ListSnapshotReposByInstanceId Queries the shared OSS repositories configured for an Elasticsearch cluster.
ListTagResources Queries the resources to which tags are added.
ListTags Queries all visible user tags.
ListVpcEndpoints Queries the statuses of endpoints in the VPC within the Elasticsearch service account.
MigrateToOtherZone Migrates nodes in an Elasticsearch cluster from one zone to another zone.
ModifyDeployMachine Updates the ECS instances on which a Beats shipper is installed.
ModifyElastictask Updates auto scaling rules configured for an Elasticsearch cluster.
ModifyInstanceMaintainTime Enables and modifies the maintenance window of an Elasticsearch cluster.
ModifyWhiteIps Updates the IP address whitelist of an Elasticsearch cluster.
MoveResourceGroup Changes the resource group to which an Elasticsearch cluster belongs.
OpenDiagnosis Enables intelligent O&M for an Elasticsearch cluster.
OpenHttps Enables HTTPS for an Elasticsearch cluster.
PostEmonTryAlarmRule Sends alert notifications for testing.
RecommendTemplates Obtains configurations recommended for an Elasticsearch cluster.
ReinstallCollector Installs a Beats shipper that fails to be installed when you create the shipper.
RenewInstance Renews a subscription Elasticsearch cluster.
RestartCollector Restarts a Beats shipper.
RestartInstance Restarts an Elasticsearch cluster.
RestartLogstash Restarts a Logstash cluster.
ResumeElasticsearchTask Resumes a change task of an Elasticsearch cluster.
ResumeLogstashTask Resumes a change task of a Logstash cluster.
RunPipelines Runs pipelines in a Logstash cluster.
ShrinkNode Scales in an Elasticsearch cluster.
StartCollector Starts a Beats shipper.
StopCollector Stops a Beats shipper that is running.
StopPipelines Stops Logstash pipelines that are running.
TagResources Adds tags to resources.
TransferNode Runs a data migration task for an Elasticsearch cluster.
TriggerNetwork Enables or disables the Public Network Access or Private Network Access feature for Elasticsearch or Kibana.
UninstallKibanaPlugin Removes a Kibana plug-in.
UninstallLogstashPlugin Removes a Logstash plug-in.
UninstallPlugin Removes an Elasticsearch plug-in.
UntagResources Removes tags from resources.
UpdateAdminPassword Updates the password of the elastic account of an Elasticsearch cluster.
UpdateAdvancedSetting Updates the garbage collector (GC) configuration of an Elasticsearch cluster.
UpdateAliwsDict Updates the dictionary file of the analysis-aliws plug-in.
UpdateCollector Updates the configuration of a Beats shipper.
UpdateCollectorName Updates the name of a Beats shipper.
UpdateDescription Updates the name of an Elasticsearch cluster.
UpdateDiagnosisSettings Updates settings for intelligent O&M for an Elasticsearch cluster.
UpdateDict Performs a standard update for dictionaries, including the built-in IK main dictionary and stopword list of the analysis-ik plug-in.
UpdateExtendfiles Updates the third-party libraries of a Logstash cluster.
UpdateHotIkDicts Performs a rolling update for dictionaries, including the built-in IK main dictionary and stopword list of the analysis-ik plug-in.
UpdateInstance Updates the configurations of an Elasticsearch cluster.
UpdateInstanceChargeType Switches the billing method of an Elasticsearch cluster from pay-as-you-go to subscription.
UpdateInstanceSettings Updates the configuration in the YML file of an Elasticsearch cluster.
UpdateKibanaSettings Updates the configuration of Kibana.
UpdateKibanaWhiteIps Updates the IP address whitelist that controls access to the Kibana console of an Elasticsearch cluster.
UpdateLogstash Updates some information of a Logstash cluster, such as the number of nodes, specifications of each node, name, and hard disk size.
UpdateLogstashDescription Updates the name of a Logstash cluster.
UpdateLogstashSettings Updates the configurations of a Logstash cluster.
UpdatePipelineManagementConfig Updates the management method of pipelines in a Logstash cluster.
UpdatePipelines Updates the information of pipelines in a Logstash cluster.
UpdatePrivateNetworkWhiteIps Updates the private IP address whitelist of an Elasticsearch cluster.
UpdatePublicNetwork Enables or disables the Public Network Access feature for an Elasticsearch cluster.
UpdatePublicWhiteIps Updates the public IP address whitelist of an Elasticsearch cluster.
UpdateReadWritePolicy Enables or disables the high availability feature for write operations on an Elasticsearch cluster. You can enable or disable the high availability feature for write operations only for Elasticsearch clusters that reside in the China (Beijing) region.
UpdateSnapshotSetting Update the data backup settings of an Elasticsearch cluster.
UpdateSynonymsDicts Updates the synonym dictionary of an Elasticsearch cluster.
UpdateWhiteIps Updates the private IP address whitelist of an Elasticsearch cluster.
UpdateXpackMonitorConfig Updates the configuration of the X-Pack Monitoring feature of a Logstash cluster.
UpgradeEngineVersion Updates the version or kernel version of an Elasticsearch cluster.
ValidateConnection Tests the connectivity between a Logstash cluster and its associated Elasticsearch cluster when you configure the X-Pack Monitoring feature for the Logstash cluster.
ValidateShrinkNodes Checks whether specific nodes in an Elasticsearch cluster can be removed.
ValidateSlrPermission Checks whether a service-linked role is created.
ValidateTransferableNodes Checks whether data stored on specific nodes in an Elasticsearch cluster can be migrated.