# Is there a way to get less used/searched logs in Elasticsearch

**URL:** https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081
**Category:** Elasticsearch
**Tags:** eql-elastic-query-language
**Created:** [March 20, 2023, 2:03pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081 "2023-03-20T14:03:23Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Amulya\_Nanda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amulya_nanda/32/118004_2.png) [@Amulya\_Nanda](https://discuss.elastic.co/u/Amulya_Nanda)
#### Post date: [March 20, 2023, 2:03pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081/1 "2023-03-20T14:03:23Z")

</div>

Hi Team,

We are looking to list out less usage logs in Elasticsearch.  
For example: we have logs getting ingested from many setups. We wanted to query/ or list out less used logs from setups basis.

How can we get the details of it?

Please can someone help us here

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 21, 2023, 8:03am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081/2 "2023-03-21T08:03:49Z")

</div>

By less used do you mean those with the smallest number of entries?

---

<div class="post-metadata">

### Author: ![Amulya\_Nanda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amulya_nanda/32/118004_2.png) [@Amulya\_Nanda](https://discuss.elastic.co/u/Amulya_Nanda)
#### Post date: [March 21, 2023, 8:08am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081/3 "2023-03-21T08:08:14Z")

</div>

No @warkolm

We are having setups example: setup1 & setup2. From these setups we are getting huge logs. These logs are parsed and extracted wrt logstash.  
And we are having a field called cluster\_id ( all logs will be having cluster\_id field)

Out of each setup there are 50-60 cluster\_id logs are getting ingested.  
Here we need to get the list of cluster\_id logs which user's are not at all searching??

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 21, 2023, 8:10am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081/4 "2023-03-21T08:10:11Z")

</div>

Elasticsearch has no way of natively showing what logs are and are not being searched sorry, it's not monitoring data that is tracked.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 21, 2023, 8:10am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081/5 "2023-03-21T08:10:39Z")

</div>

If the logs are in the same index/set of indices there are no stats available that tracks how users are filtering queries/dashboards.

---

<div class="post-metadata">

### Author: ![Amulya\_Nanda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amulya_nanda/32/118004_2.png) [@Amulya\_Nanda](https://discuss.elastic.co/u/Amulya_Nanda)
#### Post date: [March 21, 2023, 11:24am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081/6 "2023-03-21T11:24:07Z")

</div>

@warkolm does the audit logs helps us ? Any other way to get the details of less queried logs in Elasticsearch?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2023, 11:24am UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-less-used-searched-logs-in-elasticsearch/328081/7 "2023-04-18T11:24:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
