I have configured the slowlog to log out the queries and that is working. However, it is logging the queries exactly as they are sent to elastic, not the query that is produced by shield based on the user's roles.
Is there a way to get the query AFTER shield has added the role information?
Unfortunately this is not audited today, but we will definitely consider this as part of future enhancements to our auditing.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.