How to get the data related to creation, modification, deletion of a particular index

[gndivya]

Hi,

I want to check when the index was created, modified or deleted from internal logs(also other details of this particular operation). Is there any way to query this data?

[gaurav_maniar · Accepted solution]

Hi,

Try the below search query,
- the first part will give details regarding action performed on Index (create, edit, remove)
- subquery after join will provide the parameter and other details for the action

index=_audit action=indexes_edit operation IN (create, edit, remove) 
| rename object as idx 
| bin span=1m _time 
| join type=outer _time, idx 
    [ search index=_internal params=* 
    | bin span=1m _time 
    | stats first(params) as params by _time, idx]
| table _time, user, operation, idx, params

accept & up-vote the answer if it helps.