So it's a duplicate of Does Elasticsearch capture audit logs for Query DSL, EQL and SQL or Not?. Please don't open many threads for the same problem.
I'm going to close this one as this is solved.
Please make sure with your colleagues that you are not asking the same thing again and again. It's a waste of time for all the volunteers on this forum.