# Logging all queries to the cluster
**URL:** https://discuss.elastic.co/t/logging-all-queries-to-the-cluster/153826
**Category:** Elasticsearch
**Created:** [October 24, 2018, 1:59pm UTC](https://discuss.elastic.co/t/logging-all-queries-to-the-cluster/153826 "2018-10-24T13:59:26Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@AvivCohn](https://discuss.elastic.co/u/AvivCohn)
#### Post date: [October 24, 2018, 1:59pm UTC](https://discuss.elastic.co/t/logging-all-queries-to-the-cluster/153826/1 "2018-10-24T13:59:27Z")
Hello everyone,
In our organization we have a major use case of identifying who is querying the cluster, and how.
This is because we often have problems with clusters that often turn out to result from a user sending a really heavy query to the cluster, hurting the performance of the cluster.
Are there recommended methods of logging all queries to the cluster, including the IP that they were issued from?
Thank you
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 25, 2018, 3:33am UTC](https://discuss.elastic.co/t/logging-all-queries-to-the-cluster/153826/2 "2018-10-25T03:33:53Z")
I'm not sure we have a recommended path, but you could use Packetbeat to do it.
---
### Author:  [@AvivCohn](https://discuss.elastic.co/u/AvivCohn)
#### Post date: [October 27, 2018, 5:56pm UTC](https://discuss.elastic.co/t/logging-all-queries-to-the-cluster/153826/3 "2018-10-27T17:56:24Z")
Hey warkolm, thank you for the reply.
Apart from using PacketBeat and FileBeat, is there some product in XPack which does this? In particular, does Security log somewhere all queries issued to the cluster? Or is the Audit logging feature just for logging authentocation attempts without the actual queries issued?
---
### Author:  [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)
#### Post date: [October 27, 2018, 9:24pm UTC](https://discuss.elastic.co/t/logging-all-queries-to-the-cluster/153826/4 "2018-10-27T21:24:25Z")
hi @AvivCohn , as an option you can try use some proxy before elasticsearch and there implement logging of input queries
p.s. I haven't tried myself
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 28, 2018, 7:57am UTC](https://discuss.elastic.co/t/logging-all-queries-to-the-cluster/153826/5 "2018-10-28T07:57:34Z")
X-Pack can do selective logging, yes. At this stage though it's a little more [high level](https://www.elastic.co/guide/en/elasticsearch/reference/current/auditing-settings.html).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 25, 2018, 8:01am UTC](https://discuss.elastic.co/t/logging-all-queries-to-the-cluster/153826/6 "2018-11-25T08:01:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.