Hi, we set up a new ELK Cluster and enabled audit logging: Is there any possibility to log the username and all queries done by the user? In the audit log we just see successful / failed logins etc. but never any queries. Thanks. Regards Carsten

Hi @ol3k , Not all events contain the request_body attribute. In this case, access_granted events do not. Look at the authentication_* events (if you have enabled them). The reason is that the REST request content is gone by the time actions are authorized (access_granted events). Arguably the docs…

Log users and query in audit log

Elastic Stack Elasticsearch

ol3k June 4, 2018, 5:49am 8

Hi @Albert_Zaharovits,
hi @JKhondhu,

OK, thanks for your detailed answer.

Anyway thanks for your help in this thread.

2 Likes

Topic		Replies	Views
Audit logging - Is it possible to include request_body to event type access_granted? Elasticsearch elastic-stack-security	2	832	July 6, 2017
Auditing Security Events visualizing Kibana elastic-stack-security	14	859	November 28, 2018
Elasticsearch Not Logging Query Details Despite Enabling Audit Logs Elasticsearch elastic-stack-monitoring	10	144	April 7, 2025
Log the User and Query submited thru Kibana Kibana	1	2002	June 19, 2017
Issues with Audit Log Elasticsearch	8	1359	January 4, 2018

Log users and query in audit log

Related topics