# Check where a query comes from
**URL:** https://discuss.elastic.co/t/check-where-a-query-comes-from/225601
**Category:** Elasticsearch
**Created:** [March 30, 2020, 2:52am UTC](https://discuss.elastic.co/t/check-where-a-query-comes-from/225601 "2020-03-30T02:52:49Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)
#### Post date: [March 30, 2020, 2:52am UTC](https://discuss.elastic.co/t/check-where-a-query-comes-from/225601/1 "2020-03-30T02:52:49Z")
ES version 7.6.1
I notice that there are some problematic queries in my cluster, but i have no idea where they come from.
I'd wonder if I can find the source IP/hostname of a query?
Thanks
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 30, 2020, 8:25am UTC](https://discuss.elastic.co/t/check-where-a-query-comes-from/225601/2 "2020-03-30T08:25:56Z")
If you have a gold/plat license, you can activate [the audit log](https://www.elastic.co/guide/en/elasticsearch/reference/current/enable-audit-logging.html).
Otherwise, you probably need to add something like a reverse proxy (nginx or so) and read the logs?
I'm not sure that "slow logs" actually displays the source URL but just the slow query itself.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 27, 2020, 8:26am UTC](https://discuss.elastic.co/t/check-where-a-query-comes-from/225601/3 "2020-04-27T08:26:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.