Hi there,
I am with ELK 7.13.0 the basic free licence.
Is there a way to monitor the queries that are performed via the Elastic API? Even to keep the last N most recent ones for example.
I basically have different python programs with a variety of libraries from panda-es to hadoop-spark which I want to assess in terms of performance and how queries are actually translated.
I don't use Logstash or any of the filebeats just pure API calls.
Cheers.
There is audit logging in Gold and above subscriptions.
Otherwise you can tweak the slowlogs to record everything and then parse that, or use Packetbeat to track traffic on 9200, but that's DIY.
Thanks for the pointer, with regards to the DIY solution, I don't believe Packetbeat will be able to MIDM when I am using an SSL configuration (even if is self signed) right?
That's correct.
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.