Activity logging
Activity logging records actions taken by users and systems in your Elastic environment, such as authentication events, search queries, and configuration changes. Use these logs for security auditing, compliance, debugging, and performance investigation.
You can enable Elasticsearch and Kibana logging features to gain insight into Elastic Stack operations and diagnose issues. To configure these logs, refer to Operational logging.
Query and performance logging helps you understand how queries perform and identify operations that need optimization. Use these logs to debug slow queries, audit search activity, and analyze indexing performance.
For search operations, query logging is the recommended approach because it captures end-to-end request duration across all query types with a single configuration. Slow logs measure shard-level execution time and are the only option for indexing operations.
| Feature | Description | Availability |
|---|---|---|
| Query logging in Elasticsearch | Log every search, ES|QL, SQL, or EQL query for analysis and debugging. |
|
| Slow query and index logging in Elasticsearch | Identify slow queries and indexing operations. |
|
If query logging is not available in your Elastic Stack version, audit logging can also capture query sources.
Audit logging tracks security-related events such as authentication attempts, authorization decisions, and configuration changes.
Stack audit logging records security events inside your cluster. Cloud audit trail records organization-level actions around your deployments. On FedRAMP environments, use both for full coverage.
| Feature | Description | Availability |
|---|---|---|
| Stack security event audit logging | Enable and configure audit logging for Elasticsearch and Kibana deployments. Captures security events such as authentication, authorization, and configuration changes. |
|
| Elastic Cloud audit trail | Audit organization-level actions such as sign-in activity, deployment management, user and role changes, and API key usage. |
|
Activity logs record events for later analysis. For real-time visibility into running queries, use Query activity. For real-time cluster health and performance monitoring, refer to the monitoring tools available for your deployment type.
Kibana user activity logging logs user actions in Kibana, such as dashboard views, creation, and updates. Unlike audit logging, which tracks security compliance events like authentication and authorization decisions, user activity logging records day-to-day interactions with Kibana. For example, you can use these logs to understand which dashboards your team relies on.