Logs and loggingedit

Learn about Enterprise Search logs and logging within the following documentation:

Manage logs – Learn how to manage your logs on Elastic Cloud, or on your own deployment
View and query logs – Learn how to use two Kibana tools to view and query your logs
Manage log retention – Learn how to manage log retention policies
Audit logging guide – Learn how Enterprise Search handles audit logging
Logs quick reference – Consult this quick reference for key information such as log types, index patterns, and filenames

The following known issues affect Enterprise Search logs and logging:

(Fixed 8.5.3) Deployments do not collect Enterprise Search logs when using Docker images

This issue is known to affect Enterprise Search versions 8.5.0, 8.5.1, and 8.5.2. A fix for this issue is expected in 8.5.3.

The issue affects deployments using Elastic Cloud, Elastic Cloud Enterprise, and Elastic Cloud on Kubernetes. It also affects self-managed deployments using Docker images. The issue does not affect self-managed deployments using packages.

Affected deployments do not collect analytics, API logs, and other Enterprise Search logs.
(Fixed 8.5.3) Deployments do not collect Enterprise Search logs when using Enterprise Search service account tokens

This issue is known to affect Enterprise Search versions 8.5.0, 8.5.1, and 8.5.2. A fix for this issue is expected in 8.5.3.

The issue affects self-managed deployments that have configured Enterprise Search to connect to Elasticsearch using the Enterprise Search service account token (elasticsearch.service_account_token).

Affected deployments do not collect analytics, API logs, and other Enterprise Search logs.

Affected deployments can work around this issue by additionally configuring a username and password to connect to Elasticsearch (elasticsearch.username) and (elasticsearch.password). These credentials will be used to ingest analytics, logs, and metrics data. Other Enterprise Search processes will continue to use the service account token.