I would like to get metrics about how many requests does Elasticsearch receive grouped by ip of the request sender.
My objective is to find which of my services are querying the most.
I checked the stats endpoint but found no hint.
Thanks in advance
You'll want the ES audit log for that: Enable audit logging | Elasticsearch Guide [8.3] | Elastic
Those events will contain an
origin.address. You won't get exact per-query info but you will get info about connection & authentication.
Auditing search queries | Elasticsearch Guide [8.3] | Elastic has some details on how to get more query details.
The X-Opaque-Id header can also be helpful when trying to find clients causing slow queries or long-running tasks.