# Enable Response Body in APM securely?

**URL:** <https://discuss.elastic.co/t/enable-response-body-in-apm-securely/388627>\
**Category:** APM\
**Tags:** java, nodejs, open-telemetry\
**Created:** [July 22, 2026, 11:16am UTC](https://discuss.elastic.co/t/enable-response-body-in-apm-securely/388627 "2026-07-22T11:16:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kkumar123](https://avatars.discourse-cdn.com/v4/letter/k/e9c0ed/32.png) [@kkumar123](https://discuss.elastic.co/u/kkumar123)\
**Post date:** [July 22, 2026, 11:16am UTC](https://discuss.elastic.co/t/enable-response-body-in-apm-securely/388627/1 "2026-07-22T11:16:30Z")

</div>

Looking for enabling the APM Response body from Kibana or Observability UI instead of code

if not possible then how we can do it code but securely.

**Kibana version** : 9.3.4

**Elasticsearch version** : 9.3.4

**APM Server version** : v9.3.4

**APM Agent language and version** : nodejs (4.15.0, 4.6.0) , java (1.54.0,1.50.0) , opentelemetry/swift (1.6.0)

**Application Frameworks:** express (4.18.2,4.19.2), java ( java language 21.0.3), kafka, opentelemetry/swift

---

<div class="post-metadata">

**Author:** ![Jack\_Shirazi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_shirazi/32/91641_2.png) [@Jack\_Shirazi](https://discuss.elastic.co/u/Jack_Shirazi)\
**Post date:** [July 22, 2026, 11:42am UTC](https://discuss.elastic.co/t/enable-response-body-in-apm-securely/388627/2 "2026-07-22T11:42:20Z")

</div>

I think you are looking for some of these options: [HTTP configuration options | APM Java agent](https://www.elastic.co/docs/reference/apm/agents/java/config-http) - if not, please clarify your question further

---

<div class="post-metadata">

**Author:** ![kkumar123](https://avatars.discourse-cdn.com/v4/letter/k/e9c0ed/32.png) [@kkumar123](https://discuss.elastic.co/u/kkumar123)\
**Post date:** [July 28, 2026, 2:45pm UTC](https://discuss.elastic.co/t/enable-response-body-in-apm-securely/388627/3 "2026-07-28T14:45:46Z")

</div>

> [@kkumar123](#):
>
> if not possible then how we can do it code but securely.

Like we want to enabled the request response body's in in the transaction we have enabled the headers but want the what response was to that request in transactions with complete details currently we have the following in transaction:

1. **http.request.headers**

2. http.request.body.original

3. **http.response.headers**

4. we want to see the body of the response

---

<div class="post-metadata">

**Author:** ![longchung90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/longchung90/32/147505_2.png) [@longchung90](https://discuss.elastic.co/u/longchung90)\
**Post date:** [August 3, 2026, 7:24pm UTC](https://discuss.elastic.co/t/enable-response-body-in-apm-securely/388627/4 "2026-08-03T19:24:38Z")

</div>

Hi, you might need to go back and ingest the body further, `body` field is common in Otel schema, and it is `message` field with ESC. Both of them you can also ingest after the data already onboarded. The method tht the component called such as POPST/GET/PUT etc along with the component name or constituents are also found in these two fields. The new fields that we need for this type of monitoring are ordinarily nested very deep after in the top level. So we don't want field explosion but at the same time, we have the luxury of ingest first then parse. These two fields: body and message can sometimes be mistaken as keyword, instead of text and that can cause a bit of a trouble.