# How to identify specific users who are submitting slowlog queries?
**URL:** https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120
**Category:** Elasticsearch
**Tags:** elastic-stack-monitoring
**Created:** [August 15, 2022, 7:35pm UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120 "2022-08-15T19:35:51Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Apprentice](https://discuss.elastic.co/u/Apprentice)
#### Post date: [August 15, 2022, 7:35pm UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/1 "2022-08-15T19:35:51Z")
I'm trying to create a dashboard that can identify slow queries and the user who submitted them. Was wondering if there were any examples/guides I could follow online as I am a bit stumped on how to go about this (am a beginner to ES).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 16, 2022, 12:24am UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/2 "2022-08-16T00:24:14Z")
Take a look at [Slow Log | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.3/index-modules-slowlog.html#_identifying_search_slow_log_origin). Basically unless you are providing information to Elasticsearch about the user making the request, it has no way of identifying them.
---
### Author:  [@Apprentice](https://discuss.elastic.co/u/Apprentice)
#### Post date: [August 16, 2022, 11:33am UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/3 "2022-08-16T11:33:30Z")
The [X-Opaque-Id http header](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/api-conventions.html#x-opaque-id) seems like just what I need, but I was wondering how I'd go about setting that up in Elasticsearch? Only resource I could find was how to set it when using the Python library.
---
### Author:  [@Apprentice](https://discuss.elastic.co/u/Apprentice)
#### Post date: [August 16, 2022, 1:53pm UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/4 "2022-08-16T13:53:40Z")
Is there a way to set the [X-Opaque-Id http header](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/api-conventions.html#x-opaque-id) via the ECE GUI?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 16, 2022, 9:51pm UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/5 "2022-08-16T21:51:06Z")
It needs to come from whatever client talks to Elasticsearch, it's not something Elasticsearch can inject.
---
### Author:  [@Apprentice](https://discuss.elastic.co/u/Apprentice)
#### Post date: [August 17, 2022, 12:24pm UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/6 "2022-08-17T12:24:14Z")
I understand that, right now we have a bunch of settings set up from the ECE GUI via the Elasticsearch.yml file for the whole cluster (as opposed to setting it up manually for each instance individually), so I was wondering if there was a similar method to set up that property for a whole cluster in one place?
---
### Author:  [@Apprentice](https://discuss.elastic.co/u/Apprentice)
#### Post date: [August 17, 2022, 12:30pm UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/7 "2022-08-17T12:30:35Z")
Another question, as of right now the docs say to set up the [X-Opaque-Id http header](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/api-conventions.html#x-opaque-id) I would have to updated the search slow log file which is configured in the `log4j2.properties` file.
Where would I find this file?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 18, 2022, 4:49am UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/8 "2022-08-18T04:49:56Z")
It says;
> You can pass an `X-Opaque-Id` HTTP header to track the origin of a request in Elasticsearch logs and tasks. If provided, Elasticsearch surfaces the `X-Opaque-Id` value in the:
>
> - Response of any request that includes the header
> - [Task management API](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/tasks.html#_identifying_running_tasks) response
> - [Slow logs](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/index-modules-slowlog.html#_identifying_search_slow_log_origin)
> - [Deprecation logs](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/logging.html#deprecation-logging)
Basically, as long as the HTTP request that you are making to Elasticsearch **contains** this information, it will be **added** to the existing slow logs. It's not anything that you need to configure in Elasticsearch.
eg if I ran `curl -H "Content-Type: application/json" -XGET 0:9200/` from a host called `marks-laptop` to my cluster and it triggered into the slow log, it wouldn't show any source.
But if I ran `curl -H "Content-Type: application/json" -H "X-Opaque-Id: marks-laptop" -XGET 0:9200/` and it triggered into the slow log then it would show up, as I have passed that additional header into the request.
---
### Author:  [@Apprentice](https://discuss.elastic.co/u/Apprentice)
#### Post date: [August 18, 2022, 12:58pm UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/9 "2022-08-18T12:58:01Z")
Ah, it's entirely a client side feature. Whoever is using it will have to make sure it's included.
Is there a similar feature to implement on Kibana? As that is where I need to get it working and I haven't found any docs related to that.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 18, 2022, 10:08pm UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/10 "2022-08-18T22:08:13Z")
I don't believe there is a way for Kibana sorry. It might be worth raising a feature request on GitHub.
---
### Author:  [@matschaffer](https://discuss.elastic.co/u/matschaffer)
#### Post date: [August 26, 2022, 7:19am UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/11 "2022-08-26T07:19:50Z")
We had a recent [blog post about tracing kibana](https://www.elastic.co/blog/3-tips-to-identify-kibana-optimizing-potential) that might help with this space.
The feature is still very early though so I'm not sure if you could use it to identify specific users/dashboards yet.
I opened [Dashboard-centric APM transaction titles · Issue #134281 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/134281) to at least include dashboard names in the transaction titles which should help highlight high impact (latency + throughput) dashboards.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 23, 2022, 7:20am UTC](https://discuss.elastic.co/t/how-to-identify-specific-users-who-are-submitting-slowlog-queries/312120/12 "2022-09-23T07:20:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.