# How can I get a client ip of search request in ielasticsearch?
**URL:** https://discuss.elastic.co/t/how-can-i-get-a-client-ip-of-search-request-in-ielasticsearch/348284
**Category:** Elasticsearch
**Created:** [November 30, 2023, 3:18am UTC](https://discuss.elastic.co/t/how-can-i-get-a-client-ip-of-search-request-in-ielasticsearch/348284 "2023-11-30T03:18:13Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@yunpeng.jiangyp](https://discuss.elastic.co/u/yunpeng.jiangyp)
#### Post date: [November 30, 2023, 3:18am UTC](https://discuss.elastic.co/t/how-can-i-get-a-client-ip-of-search-request-in-ielasticsearch/348284/1 "2023-11-30T03:18:13Z")
Hi guys:
I found a slow search request , but i didn't know the search request's client ip . Can I get a client ip of search request in elasticsearch?
---
### Author:  [@nextgen](https://discuss.elastic.co/u/nextgen)
#### Post date: [November 30, 2023, 5:19am UTC](https://discuss.elastic.co/t/how-can-i-get-a-client-ip-of-search-request-in-ielasticsearch/348284/2 "2023-11-30T05:19:17Z")
> [@yunpeng.jiangyp](#):
>
> I found a slow search request , but i didn't know the search request's client ip . Can I get a client ip of search request in elasticsearch?
In Elasticsearch, by default, client IP addresses are not stored as part of the document data. Elasticsearch focuses on indexing and searching the content of documents rather than tracking client IP addresses for search requests. However, you can enable and configure the audit logging feature in Elasticsearch to capture information about incoming requests, including client IP addresses.
Here are the general steps to enable audit logging in Elasticsearch:
1. **Edit `elasticsearch.yml`:** Open the `elasticsearch.yml` configuration file and add or modify the following settings:
```auto
xpack.security.audit.enabled: true
xpack.security.audit.outputs:
- logfile
```
Ensure that the `xpack.security.enabled` setting is also set to `true` if it's not already.
2. **Restart Elasticsearch:** After making changes to the configuration, restart Elasticsearch to apply the new settings.
3. **Check the Audit Log:** The audit log will now contain information about incoming requests, including client IP addresses. You can find the audit log in the Elasticsearch data directory under the `logs` subdirectory.
Keep in mind that enabling audit logging may have performance implications, and the logs can grow in size, so it's essential to configure log rotation and retention policies.
It's important to note that the specific steps and settings might vary depending on the Elasticsearch version and whether you have a basic or commercial license. Additionally, if you are using a security plugin like X-Pack, you may need to adjust settings accordingly.
---
### Author:  [@yunpeng.jiangyp](https://discuss.elastic.co/u/yunpeng.jiangyp)
#### Post date: [December 1, 2023, 2:36am UTC](https://discuss.elastic.co/t/how-can-i-get-a-client-ip-of-search-request-in-ielasticsearch/348284/3 "2023-12-01T02:36:42Z")
thank you nextgen, i will try it!
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 1, 2023, 2:44am UTC](https://discuss.elastic.co/t/how-can-i-get-a-client-ip-of-search-request-in-ielasticsearch/348284/4 "2023-12-01T02:44:12Z")
> [@yunpeng.jiangyp](#):
>
> Can I get a client ip of search request in elasticsearch?
This is only possible if you have Audit logging enabled, do you have a paid license? Audit logging is a paid feature.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2023, 2:44am UTC](https://discuss.elastic.co/t/how-can-i-get-a-client-ip-of-search-request-in-ielasticsearch/348284/5 "2023-12-29T02:44:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.