# How can you monitor user queries when using SSL

**URL:** https://discuss.elastic.co/t/how-can-you-monitor-user-queries-when-using-ssl/219294
**Category:** Elasticsearch
**Tags:** elastic-stack-monitoring, elastic-stack-security
**Created:** [February 14, 2020, 12:00am UTC](https://discuss.elastic.co/t/how-can-you-monitor-user-queries-when-using-ssl/219294 "2020-02-14T00:00:12Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![kyles](https://avatars.discourse-cdn.com/v4/letter/k/a698b9/32.png) [@kyles](https://discuss.elastic.co/u/kyles)
#### Post date: [February 14, 2020, 12:00am UTC](https://discuss.elastic.co/t/how-can-you-monitor-user-queries-when-using-ssl/219294/1 "2020-02-14T00:00:12Z")

</div>

ES version: 7.4.2  
12 data nodes  
We have RBAC and SSL for HTTP and for node communication.

We are getting queries ran against our cluster that are causing circuit breakers errors. Is there anything we can do to to track down what user or account are running these queries?

---

<div class="post-metadata">

### Author: ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [February 14, 2020, 4:27am UTC](https://discuss.elastic.co/t/how-can-you-monitor-user-queries-when-using-ssl/219294/2 "2020-02-14T04:27:05Z")

</div>

Somewhat indirectly, the audit logs list all indexes in access granted. So, for example, someone using _beat_ will have a larger list than someone using filebeat.

Other posts describe a hack of setting the log long query time limit to 0 so all queries show in the slow log, but I've never done that myself.

---

<div class="post-metadata">

### Author: ![kyles](https://avatars.discourse-cdn.com/v4/letter/k/a698b9/32.png) [@kyles](https://discuss.elastic.co/u/kyles)
#### Post date: [February 18, 2020, 6:04pm UTC](https://discuss.elastic.co/t/how-can-you-monitor-user-queries-when-using-ssl/219294/3 "2020-02-18T18:04:09Z")

</div>

I have turned on slow logging, with the level of info. Although I can not find where it lists the userID of whom is making the queries.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 17, 2020, 6:04pm UTC](https://discuss.elastic.co/t/how-can-you-monitor-user-queries-when-using-ssl/219294/4 "2020-03-17T18:04:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.