Looking back to this thread I would like to know if there is any news about this topic.
Is there a way to add a "tag" to queries which end up in the ES index_search_slowlogs?
Generally, if I enable slowlog I have to look at hundreds thousands of messages, divided by shards. I would like to collapse them or aggregate them using a hook. How can I do that?