# How to audit search on an Elasticsearch indexes

**URL:** https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754
**Category:** Elasticsearch
**Created:** [March 3, 2022, 2:39pm UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754 "2022-03-03T14:39:32Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![chriselk](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@chriselk](https://discuss.elastic.co/u/chriselk)
#### Post date: [March 3, 2022, 2:39pm UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754/1 "2022-03-03T14:39:32Z")

</div>

We would like to have report on what type of search we have on some Elastic index, I cannot find the search in the servers logs, not sure how we could audit the search request done on an index ?  
kind of 10 most field / value search

---

<div class="post-metadata">

### Author: ![DineshNaik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dineshnaik/32/89308_2.png) [@DineshNaik](https://discuss.elastic.co/u/DineshNaik)
#### Post date: [March 3, 2022, 6:06pm UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754/2 "2022-03-03T18:06:18Z")

</div>

Have you explored slow logging ?

> **[Slow Log | Elasticsearch Guide \[8.0\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules-slowlog.html#search-slow-log)**

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 3, 2022, 11:35pm UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754/3 "2022-03-03T23:35:15Z")

</div>

There's currently nothing native that can provide this.

---

<div class="post-metadata">

### Author: ![chriselk](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@chriselk](https://discuss.elastic.co/u/chriselk)
#### Post date: [March 4, 2022, 8:09am UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754/4 "2022-03-04T08:09:01Z")

</div>

thank you , I will try this settings to see what i can get for information, in our case we are not looking it has performance issues more to understand who is searching what , but maybe tuning some of this value will allow us to see all search

---

<div class="post-metadata">

### Author: ![chriselk](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@chriselk](https://discuss.elastic.co/u/chriselk)
#### Post date: [March 4, 2022, 8:13am UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754/5 "2022-03-04T08:13:29Z")

</div>

Thank you for this information, it's Funny we are using ELK to audit all our application but we cannot audit it self 😉 (the shoemaker's son always goes barefoot )

---

<div class="post-metadata">

### Author: ![casterQ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/casterq/32/93257_2.png) [@casterQ](https://discuss.elastic.co/u/casterQ)
#### Post date: [March 4, 2022, 8:20am UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754/6 "2022-03-04T08:20:31Z")

</div>

nginx 、apisix or any gateway can help you，like this one i did before：

> **[es实战-收集Nginx日志可视化监控](https://www.jianshu.com/p/66210e4a6ee8)**
>
> 需求场景：ES 集群通过 Nginx 做了网关代理，需要把访问 ES 集群的请求进行统计监控。使用组件：Filebeat 收集，写入 ES 集群，通过 Kibana 的 da...

---

<div class="post-metadata">

### Author: ![chriselk](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@chriselk](https://discuss.elastic.co/u/chriselk)
#### Post date: [March 4, 2022, 10:50am UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754/7 "2022-03-04T10:50:52Z")

</div>

thank you good idea , this could be a solution, but we would have to change our infrastructure design

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 1, 2022, 10:51am UTC](https://discuss.elastic.co/t/how-to-audit-search-on-an-elasticsearch-indexes/298754/8 "2022-04-01T10:51:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
