---
title: "Manage Calico Enterprise logs"
description: "Configure in-cluster Elasticsearch logs for Calico Enterprise so the Manager UI, Kibana, and the Elasticsearch API can surface flow, DNS, audit, and L7 data."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Observability"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/observability/elastic/"
---

# Manage Calico Enterprise logs

## [📄️Overview](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/overview.md)

[Calico Enterprise deploys an in-cluster Elasticsearch and Kibana stack for flow, DNS, audit, BGP, and L7 logs with workload context, RBAC, and archival to SIEMs.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/overview.md)

## [📄️Configure data retention](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/retention.md)

[Set retention windows for Calico Enterprise flow, DNS, audit, BGP, L7, snapshot, and compliance report data in the in-cluster LogStorage resource.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/retention.md)

## [📄️Archive logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/archive-storage.md)

[Forward Calico Enterprise flow, DNS, audit, and L7 logs to Syslog, Splunk, or Amazon S3 to retain compliance data beyond in-cluster Elasticsearch retention.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/archive-storage.md)

## [📄️Configure RBAC for Elasticsearch logs and events](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/rbac-elasticsearch.md)

[Set fine-grained Kubernetes RBAC permissions in Calico Enterprise to control access to Elasticsearch flow, audit, DNS, and intrusion detection event indices.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/rbac-elasticsearch.md)

## [🗃Flow logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow.md)

[6 items](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow.md)

## [📄️Audit logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/audit-overview.md)

[Calico Enterprise audit logs record changes to network policies, tiers, network sets, host endpoints, and other resources for security and compliance review.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/audit-overview.md)

## [🗃DNS logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/dns.md)

[2 items](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/dns.md)

## [📄️BGP logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/bgp.md)

[Reference of key/value fields in Calico Enterprise BGP activity logs stored in Elasticsearch, with sample queries for IPv4, IPv6, and per-node lookups.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/bgp.md)

## [🗃L7 logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/l7.md)

[2 items](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/l7.md)

## [📄️Troubleshoot logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/troubleshoot.md)

[Troubleshooting guide for in-cluster Elasticsearch problems in Calico Enterprise covering LogStorage, storage classes, persistent volumes, and diagnostic logs.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/troubleshoot.md)