# Print User Information within Query Log Statements (Log4j2)

**URL:** <https://discuss.elastic.co/t/print-user-information-within-query-log-statements-log4j2/156541>\
**Category:** Elasticsearch\
**Created:** [November 13, 2018, 8:27pm UTC](https://discuss.elastic.co/t/print-user-information-within-query-log-statements-log4j2/156541 "2018-11-13T20:27:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hadingerb](https://avatars.discourse-cdn.com/v4/letter/h/2acd7d/32.png) [@hadingerb](https://discuss.elastic.co/u/hadingerb)\
**Post date:** [November 13, 2018, 8:27pm UTC](https://discuss.elastic.co/t/print-user-information-within-query-log-statements-log4j2/156541/1 "2018-11-13T20:27:05Z")

</div>

I am wondering if there is a way to log what user ran a query statement to elasticsearch. Right now I have it set up such that slowlog prints everything, just so I see what is happening, but I do not necessarily know who is querying elasticsearch.

I am slowly learning more about elasticsearch, and I am using it for a personal project just to learn more about it. I do not have x-pack, but still want to figure out more about the logging process. I did not see an elasticsearch parameter to add user information to the log statements.

I have v. 6.4.3, and have been reading more into how log4j2 is being used with the logging process, and saw that log4j2 had a ThreadContext class that one can put string keys and values into and use them in things like the .properties file.

In the patternLayout (int log4j2.properties), if I add either: $${ctx:login} or %X{login}, it will retrieve the current value set to the String "login" as put there by the ThreadContext. But I dont necessarily know whether or not this works with elastic search. Say I put a key-value pair into the log4j2 ThreadContext in my personal project code (that eventually queries elasticsearch), and have the $${ctx:} or similar in the log4j2.properties for elasticsearch, will the value I put be read correctly?

ex: (in my personal code)  
ThreadContext.put("method","getCount"); //log4j2 ThreadContext  
[execute elasticsearch query]

Will the $${ctx:method} value that is printed in the elasticsearch log (because of the change to the patternLayout in log4j2.properties) be "getCount"? even though it is not in elasticsearch directly?  
If not, I also see that Elasticsearch has a ThreadContext class that one can add "Headers" to. If my prior example doesnt work, is it possible for the user of elasticsearch to add to this ThreadContext?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 14, 2018, 2:36am UTC](https://discuss.elastic.co/t/print-user-information-within-query-log-statements-log4j2/156541/2 "2018-11-14T02:36:16Z")

</div>

If you don't have Security enabled then there's no way for Elasticsearch to capture user information, because it doesn't need to send auth details.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2018, 2:36am UTC](https://discuss.elastic.co/t/print-user-information-within-query-log-statements-log4j2/156541/3 "2018-12-12T02:36:17Z")

</div>

Closed on December 12, 2018, 2:36am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.