# Metric to count number of queries per day/month **URL:** \ **Category:** Elasticsearch\ **Created:** [February 9, 2023, 3:10am UTC](https://discuss.elastic.co/t/metric-to-count-number-of-queries-per-day-month/325076 "2023-02-09T03:10:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Milad\_Heydariaan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_heydariaan/32/116602_2.png) [@Milad\_Heydariaan](https://discuss.elastic.co/u/Milad_Heydariaan)\ **Post date:** [February 9, 2023, 3:10am UTC](https://discuss.elastic.co/t/metric-to-count-number-of-queries-per-day-month/325076/1 "2023-02-09T03:10:15Z")
Hi, I'm trying to collect the number of queries that users send to Elasticsearch to understand how many queries per day/month are submitted to our clusters. I've tried using the following metrics mentioned in [Nodes stats API | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-nodes-stats.html) `indices.search.fetch_total` `indices.search.query_total` However, I'm not sure what the two above metrics mean exactly. I'm using [Elastic integration of Datadog](https://docs.datadoghq.com/integrations/elastic/?tab=host) to collect those metrics (submitted as `elasticsearch.search.fetch.total.count` and `elasticsearch.search.query.total.count`). My idea was to aggregate the count using cumulative sum during a given period of time (1 day or 1 month) and take the last value to represent how many queries were submitted in that period. I ran a few small experiments with a few queries on a test cluster and here is what I understood: `elasticsearch.search.query.total.count` seems to count the number of docs returned by queries, which is not what we want, but the metric name is confusing. `elasticsearch.search.fetch.total.count` seems to count the number of queries, which is probably what we want, but there is a problem: An Elasticsearch cluster with not a lot of active queries shows really large numbers for `elasticsearch.search.fetch.total.count` (up to 700,000,000 per month) which is surprising and probably wrong. Am I missing something? Thanks ---
**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\ **Post date:** [February 9, 2023, 7:37am UTC](https://discuss.elastic.co/t/metric-to-count-number-of-queries-per-day-month/325076/2 "2023-02-09T07:37:35Z")
Hello @Milad_Heydariaan , welcome to the community ! I believe the stats you are referring to are correct and `_node/stats/indices/query_total` should, by definition, provide total query operations. Have you tried the command in DevConsole and compare the result with `elasticsearch.search.query.total.count` ? I'd suggest you to setup a scripted query which directly works with `_node/stats` rather than relying on Datadog or any other third party API since ES provides what you need here. ---
**Author:** ![Milad\_Heydariaan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_heydariaan/32/116602_2.png) [@Milad\_Heydariaan](https://discuss.elastic.co/u/Milad_Heydariaan)\ **Post date:** [February 15, 2023, 3:08pm UTC](https://discuss.elastic.co/t/metric-to-count-number-of-queries-per-day-month/325076/3 "2023-02-15T15:08:31Z")
Hi @Ayush_Mathur I tried testing the method you suggested with a test cluster that runs on 2 data nodes. I have an index named `test`, with 3 shards, 1 replica, and 2 documents. This is what I see: - Checked \_nodes/stats/indices first and I see: `.nodes.*.indices.search.query_total` shows 339 and 6851 (Total: 7190) `.nodes.*.indices.search.fetch_total` shows 7 and 761 (Total: 768) - Ran `GET test/_search` on Kibana Console and I get: ```auto "took" : 0, "timed_out" : false, "_shards" : { "total" : 3, "successful" : 3, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : 2, "max_score" : 1.0, "hits" : [ { "_index" : "test", "_type" : "_doc", "_id" : "UyNs24IBF2DHLrbLO01N", "_score" : 1.0, "_source" : { "number" : 10 } }, { "_index" : "test", "_type" : "_doc", "_id" : "Jwts24IBfmjNTyhJVVal", "_score" : 1.0, "_source" : { "number" : 11 } } ] } } ``` - Checked \_nodes/stats/indices again and I see: `.nodes.*.indices.search.query_total` shows 339 and 6854 (Total: 7193) `.nodes.*.indices.search.fetch_total` shows 7 and 763 (Total: 770) This is surprising to me since `query_total` was increased by 3 and `fetch_total` was increased by 2. I was expecting to see the `query_total` increasing just by 1 since I only ran 1 query. My goal is to see how many queries are flowing to our cluster and report aggregated statistics daily/monthly. If `query_total` or `fetch_total` are not suitable for what I need, is there another metric that I can use? Another question: are those metrics increasing for the lifetime of the cluster or they reset to 0 at some point? ---
**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\ **Post date:** [February 15, 2023, 3:38pm UTC](https://discuss.elastic.co/t/metric-to-count-number-of-queries-per-day-month/325076/4 "2023-02-15T15:38:01Z")
Ok, so the `query_total` increased by 3 means all 3 shards were included in your search query for data consolidation. In other words, query\_total would provide the summation of number of shards queried for your request since the cluster was last started. The `fetch_total` on the other hand provides the total hits count to your search query that were aggregated for response. I would suggest to look into auditing of ES and Kibana and capture the audit logs in ES (using filebeat): [Collecting Elasticsearch log data with Filebeat | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-filebeat.html) It provides some fields under the hood like origin.type, user.run\_as\_name, action, etc. that can be further used to create scripts and visualizations. For fields reference, read here: [Elasticsearch fields | Filebeat Reference [8.6] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/8.6/exported-fields-elasticsearch.html) In addition, there are few properties exposed for this as mentioned in PR: [Enable logging in ES client by albertteoh · Pull Request #2862 · jaegertracing/jaeger · GitHub](https://github.com/jaegertracing/jaeger/pull/2862) And some solution provided in StackOverflow: [debugging - How to log all executed elasticsearch queries - Stack Overflow](https://stackoverflow.com/questions/21749997/how-to-log-all-executed-elasticsearch-queries) Furthermore, if you would like to log ES queries executed from Kibana, you can refer: [Examples | Kibana Guide [8.6] | Elastic](https://www.elastic.co/guide/en/kibana/current/log-settings-examples.html#log-elasticsearch-queries) ---
**Author:** ![Milad\_Heydariaan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_heydariaan/32/116602_2.png) [@Milad\_Heydariaan](https://discuss.elastic.co/u/Milad_Heydariaan)\ **Post date:** [February 15, 2023, 6:23pm UTC](https://discuss.elastic.co/t/metric-to-count-number-of-queries-per-day-month/325076/5 "2023-02-15T18:23:00Z")
So, it seems there is no way to directly get this info from ES. I'll try the log-based solution you suggested. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 15, 2023, 6:23pm UTC](https://discuss.elastic.co/t/metric-to-count-number-of-queries-per-day-month/325076/6 "2023-03-15T18:23:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.