Monitoring API query

There is audit logging in Gold and above subscriptions.

Otherwise you can tweak the slowlogs to record everything and then parse that, or use Packetbeat to track traffic on 9200, but that's DIY.