Hi @ol3k,
Complementing @JKhondhu's answer, you can log the request body by setting xpack.security.audit.logfile.events.emit_request_body: true. More info here:
https://www.elastic.co/guide/en/elasticsearch/reference/6.2/auditing-settings.html#event-audit-settings