Ok, so the query_total increased by 3 means all 3 shards were included in your search query for data consolidation. In other words, query_total would provide the summation of number of shards queried for your request since the cluster was last started.
The fetch_total on the other hand provides the total hits count to your search query that were aggregated for response.
I would suggest to look into auditing of ES and Kibana and capture the audit logs in ES (using filebeat): Collecting Elasticsearch log data with Filebeat | Elasticsearch Guide [8.6] | Elastic
It provides some fields under the hood like origin.type, user.run_as_name, action, etc. that can be further used to create scripts and visualizations. For fields reference, read here: Elasticsearch fields | Filebeat Reference [8.6] | Elastic
In addition, there are few properties exposed for this as mentioned in PR: Enable logging in ES client by albertteoh · Pull Request #2862 · jaegertracing/jaeger · GitHub
And some solution provided in StackOverflow: debugging - How to log all executed elasticsearch queries - Stack Overflow
Furthermore, if you would like to log ES queries executed from Kibana, you can refer: Examples | Kibana Guide [8.6] | Elastic