# Log Queries Produced by Shield

**URL:** <https://discuss.elastic.co/t/log-queries-produced-by-shield/53803>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 23, 2016, 4:17pm UTC](https://discuss.elastic.co/t/log-queries-produced-by-shield/53803 "2016-06-23T16:17:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adam\_Stortz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adam_stortz/32/10258_2.png) [@Adam\_Stortz](https://discuss.elastic.co/u/Adam_Stortz)\
**Post date:** [June 23, 2016, 4:17pm UTC](https://discuss.elastic.co/t/log-queries-produced-by-shield/53803/1 "2016-06-23T16:17:18Z")

</div>

I have configured the slowlog to log out the queries and that is working. However, it is logging the queries exactly as they are sent to elastic, not the query that is produced by shield based on the user's roles.

Is there a way to get the query AFTER shield has added the role information?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [June 23, 2016, 9:54pm UTC](https://discuss.elastic.co/t/log-queries-produced-by-shield/53803/2 "2016-06-23T21:54:16Z")

</div>

Unfortunately this is not audited today, but we will definitely consider this as part of future enhancements to our auditing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:43pm UTC](https://discuss.elastic.co/t/log-queries-produced-by-shield/53803/3 "2017-07-06T13:43:43Z")

</div>


