Has anyone come up with a good way to record for later auditing the queries that are run by users within the Elasticsearch environment? I know you can record queries using the Slow Log feature, however, I thought that there must be a better way of handling this than setting slow log features for each index and even then the slow logs do not record (unless missing it) the user account under which is ran.
If you want to know which user runs which query you need to have audit enabled.
Audit requires a paid license.