Analytic Query logging by smalyshev · Pull Request #139920 · elastic/elasticsearch

smalyshev · 2025-12-22T23:49:43Z

This patch creates framework for generic action logging, serving search, SQL, EQL, ESQL, etc. Enabling logging:

elasticsearch.actionlog.search.enabled=true

Will produce search logs in JSON format like this:

{
	"@timestamp": "2026-02-06T20:22:41.345Z",
	"log.level": "INFO",
	"auth.type": "REALM",
	"elasticsearch.activitylog.hits": 3,
	"elasticsearch.activitylog.indices": "my-index",
	"elasticsearch.activitylog.query": "{\"size\":1,\"fields\":[{\"field\":\"id\"},{\"field\":\"title\"},{\"field\":\"_tier\"}]}",
	"elasticsearch.activitylog.took": 1000000,
	"elasticsearch.activitylog.took_millis": 1,
	"elasticsearch.activitylog.type": "search",
	"event.duration": 1000000,
	"event.outcome": "success",
	"user.name": "elastic",
	"user.realm": "reserved",
	"ecs.version": "1.2.0",
	"service.name": "ES_ECS",
	"event.dataset": "elasticsearch.search_log",
	"process.thread.name": "elasticsearch[node-1][search][T#8]",
	"log.logger": "search.activitylog",
	"elasticsearch.cluster.uuid": "gjYgb-uQQAuLmDoKlQInZw",
	"elasticsearch.node.id": "juurGSfgRYGwTP2ttZbtOQ",
	"elasticsearch.node.name": "node-1",
	"elasticsearch.cluster.name": "querying"
}

elasticsearchmachine · 2025-12-22T23:50:36Z

Hi @smalyshev, I've created a changelog YAML for you.

consulthys

Thanks for the updates.
Added some comments

server/src/main/java/org/elasticsearch/common/logging/activity/ActivityLogProducer.java

consulthys · 2026-02-07T08:01:31Z

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/logging/EqlLogProducer.java

+    @Override
+    public ESLogMessage produce(EqlLogContext context, ActionLoggingFields additionalFields) {
+        ESLogMessage msg = produceCommon(context, additionalFields);
+        msg.field(ES_FIELDS_PREFIX + "query", context.getQuery());


Since ES_FIELDS_PREFIX is elasticsearch.activitylog. I feel these search-specific fields should go into another sub-section dedicated to search if in the future we were to add more non-search-related activities. Makes sense?
Thoughts @jimczi ?

Not sure if having query in separate places for different modules is beneficial, but it's possible to do, please tell which one is preferred.

My point is that the elasticsearch.activitylog. is not about search/query activities specifically. If the activity logs get extended at some point to also include other non-search activities, all the search-specified fields (i.e. took, took_ms, query, indices, etc) should be in their own sub-section (e.g. elasticsearch.activitylog.search.took, etc)

OK I see what you mean here, but I am not sure how to better configure this space. "search" name would be confusing, as there's separate module "search". So the question is - do we want to have separate section for each module (despite a lot of info being common between them) or we have a section for all "searching/reading/querying" modules and potentially another section for "indexing"?

I think we need to discuss it more in detail, but I don't want to hold this patch for this - I think after we figure it out we'd do a followup if necessary?

consulthys · 2026-02-07T08:02:10Z

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/querylog/EsqlLogProducer.java

+    @Override
+    public ESLogMessage produce(EsqlLogContext context, ActionLoggingFields additionalFields) {
+        ESLogMessage msg = produceCommon(context, additionalFields);
+        return msg.field(ES_FIELDS_PREFIX + "query", context.getQuery());


Same comment as for EQL above and having another sub-section dedicated to search

consulthys · 2026-02-07T08:02:27Z

x-pack/plugin/sql/src/main/java/org/elasticsearch/xpack/sql/logging/SqlLogProducer.java

+    @Override
+    public ESLogMessage produce(SqlLogContext context, ActionLoggingFields additionalFields) {
+        ESLogMessage msg = produceCommon(context, additionalFields);
+        return msg.field(ES_FIELDS_PREFIX + "query", context.getQuery()).field(ES_FIELDS_PREFIX + "rows", context.getRows());


Same comment as for EQL above and having another sub-section dedicated to search

server/src/main/java/org/elasticsearch/common/logging/activity/ActivityLogger.java

mark-vieira · 2026-02-12T21:55:48Z

server/src/main/java/org/elasticsearch/node/NodeConstruction.java

        );

-        List<? extends ActionLoggingFieldsProvider> slowLogFieldProviders = pluginsService.loadServiceProviders(
+        List<? extends ActionLoggingFieldsProvider> loggingFieldsProviders = pluginsService.loadServiceProviders(


Should we rename ActionLoggingFieldProvider to ActivityLoggingFieldProvider for consistency?

Not necessarily, they are not strongly linked - any logger can use ActionLoggingFieldProvider (and slowlogs, while they exist, do still use it).

Is there a plan to make slow logs an ActivityLogProducer or is it going to remain it's own thing? It'd be nice to just consolidate all these things as "activity logs" and not have slow logs be a one-off.

That depends on what you mean by "plan". We agree that eventually we'd want all those to merge into the new system, but it's not a high priority right now, though eventually that's where we want to end up. Probably starting with ESQL log, then search slow log, than indexing slow log (indexing is the last because current system doesn't support indexing yet). But we do not have a definite plan of when and who will be doing it. Here's issue for ESQL: #142425 for the rest I don't think it's tracked yet (@naj-h may know more).

I think we could discuss eventually renaming ActionLoggingFieldsProvider if slow logs go away (which may happen in the future) but it's probably not the time yet for this patch.

We agree that eventually we'd want all those to merge into the new system, but it's not a high priority right now, though eventually that's where we want to end up.

Yeah, that's good enough for me. Just wanted to make sure we're aligned that we do want to consolidate these.

x-pack/plugin/sql/src/main/java/org/elasticsearch/xpack/sql/plugin/TransportSqlQueryAction.java

...ck/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/TransportEqlSearchAction.java

distribution/src/config/log4j2.properties

server/src/main/java/org/elasticsearch/common/logging/activity/ActivityLogProducer.java

Co-authored-by: Mark Vieira <portugee@gmail.com>

Query logging

503c60e

smalyshev added >enhancement v9.4.0 :Search Foundations/Search Catch all for Search Foundations labels Dec 22, 2025

Update docs/changelog/139920.yaml

3ed392d

smalyshev and others added 24 commits December 23, 2025 10:57

tests fix

b2f4845

Also add esql

54b4128

Merge branch 'main' into analytics-logging

3aacc5b

Merge branch 'main' into analytics-logging

91d422b

Tweaks and tests

d3888c5

[CI] Auto commit changes from spotless

ea907e5

Merge branch 'main' into analytics-logging

d522c95

add SQL and EQL

49a910a

refactor and measure times on failure too

d2947b4

changelog

7a8506b

Add test

a42296e

Add Search IT test

caa474c

avoid overspecifying

e02860b

Merge branch 'main' into analytics-logging

cfe990d

more testing

2c65036

[CI] Auto commit changes from spotless

d00d5e2

add async test

fd7d294

Add cancel test

f575bac

refactor

692c8d7

Add ESQL test

6ca10aa

use synchronized list - since it's a test class, it's the simplest way

ebc7390

add SQL test

a0bc859

Add EQL logging test

1697fd2

fix test

07fe7fa

Change field names for ECS

6491a80

smalyshev force-pushed the analytics-logging branch from 64e1a9a to 6491a80 Compare February 6, 2026 20:30

smalyshev requested review from consulthys and mark-vieira February 6, 2026 20:45

fix tests

204c191

consulthys reviewed Feb 7, 2026

View reviewed changes

smalyshev linked an issue Feb 11, 2026 that may be closed by this pull request

Implement search analytics logging #142295

Closed

7 tasks

smalyshev and others added 3 commits February 11, 2026 09:27

Move error.* to the top

e3ec23f

Merge branch 'main' into analytics-logging

69259c8

Add event.duration, some tests

f60db80

naj-h mentioned this pull request Feb 11, 2026

Implement search analytics logging #142295

Closed

7 tasks

smalyshev requested review from consulthys, naj-h and rjernst February 12, 2026 19:38

mark-vieira requested changes Feb 12, 2026

View reviewed changes

smalyshev and others added 7 commits February 12, 2026 15:07

Update distribution/src/config/log4j2.properties

55e7e12

Co-authored-by: Mark Vieira <portugee@gmail.com>

Update distribution/src/config/log4j2.properties

02a09f7

Co-authored-by: Mark Vieira <portugee@gmail.com>

Update distribution/src/config/log4j2.properties

d20d5d8

Co-authored-by: Mark Vieira <portugee@gmail.com>

Update distribution/src/config/log4j2.properties

c3e2db5

Co-authored-by: Mark Vieira <portugee@gmail.com>

Pull feedback

bf85602

spotless

8a12140

Merge branch 'main' into analytics-logging

ce2968d

smalyshev requested a review from mark-vieira February 12, 2026 23:12

Merge branch 'main' into analytics-logging

ac6060b

mark-vieira approved these changes Feb 13, 2026

View reviewed changes

Merge branch 'main' into analytics-logging

4562f61

smalyshev merged commit b8804a6 into elastic:main Feb 13, 2026
35 checks passed

smalyshev deleted the analytics-logging branch February 13, 2026 22:02

cimequinox mentioned this pull request Feb 16, 2026

[CI] EsqlClientYamlIT test {p0=esql/160_union_types/suggested_type} failing #142525

Open

pebrc mentioned this pull request Apr 2, 2026

Stack Monitoring: onboard new Elasticsearch 9.4 log file (Filebeat fileset) elastic/cloud-on-k8s#9268

Closed

Conversation

smalyshev commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticsearchmachine commented Dec 22, 2025

Uh oh!

consulthys left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

smalyshev Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

smalyshev commented Dec 22, 2025 •

edited

Loading

smalyshev Feb 12, 2026 •

edited

Loading