I am using Opendistro 1.9 having ES version 7.8.0.
I have disabled audit logging from audit.yml file setting it to false. But in ES logs i can see this ERROR message - “Default endpoint could not be created, auditlog will not work properly.” eventhough it is disabled.
This looks like general ERROR message during the ES startup. It rather says that auditlog could be affected if in use. I repro that in 1.12.
Do you see any audit logging in ES?