Skip to content
Branch: master
Find file History
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


Elasticsearch provider for Audit.NET library (An extensible framework to audit executing operations in .NET).

Store the audit events in Elasticsearch database using the NEST library.


NuGet Package To install the package run the following command on the Package Manager Console:

PM> Install-Package Audit.NET.Elasticsearch

NuGet Status NuGet Count


Please see the Audit.NET Readme


Set the static Audit.Core.Configuration.DataProvider property to set the Elasticsearch data provider, or call the UseElasticsearch method on the fluent configuration. This should be done before any AuditScope creation, i.e. during application startup.

For example:

Audit.Core.Configuration.DataProvider = new ElasticsearchDataProvider()
    ConnectionSettings = new AuditConnectionSettings(new Uri("http://localhost:9200")),
    IndexBuilder = ev => ev.EventType,
    IdBuilder = ev => Guid.NewGuid()

Or by using the fluent configuration API:

    .UseElasticsearch(config => config
        .ConnectionSettings(new Uri("http://localhost:9200"))
        .Index(auditEvent => auditEvent.EventType)
        .Id(ev => Guid.NewGuid()));

Note that you can provide the settings as a function of the Audit Event.

Provider Options


  • ConnectionSettings: The Elasticsearch connection settings. It is recommended to be an instance of AuditConnectionSettings.


  • Index: The Elasticsearch index name to use. Can be NULL to use the default index.
  • Type: The type name to use. Note that types are going to be be removed in future Elasticsearch versions. Can be NULL to use the default type name.
  • Id: The id to use for the given audit event. Can be NULL to use an auto-generated id.

Query events

This provider implements GetEvent and GetEventAsync methods to obtain an audit event by id:

var event = elasDataProvider.GetEvent(new ElasticsearchAuditEventId() { Index = "myindex", Id = "myid" });
You can’t perform that action at this time.