Get source of queries hitting indexes

Elastic Stack Elasticsearch
1

Hi all, just wondering if this is possible.

We have several tiers in elastic cloud, we would like to see when the frozen tier is being rules/dashboards/queries for our indexes so we can go through and optimise. Is there a query I can run on an index that would breakdown this info? E.g. (index, source, lookback period)

2

Welcome to our community! :smiley:

You can enable audit logging to another cluster as per Enable logging and monitoring | Elasticsearch Service Documentation | Elastic, but there's nothing otherwise out of the box to Elasticsearch to do this sorry to say.