Activity logging

Activity logging records actions taken by users and systems in your Elastic environment, such as authentication events, search queries, and configuration changes. Use these logs for security auditing, compliance, debugging, and performance investigation.

Looking for application and component logging?

You can enable Elasticsearch and Kibana logging features to gain insight into Elastic Stack operations and diagnose issues. To configure these logs, refer to Operational logging.

Query and performance logging

Query and performance logging helps you understand how queries perform and identify operations that need optimization. Use these logs to debug slow queries, audit search activity, and analyze indexing performance.

For search operations, query logging is the recommended approach because it captures end-to-end request duration across all query types with a single configuration. Slow logs measure shard-level execution time and are the only option for indexing operations.

Feature	Description	Availability
Query logging in Elasticsearch	Log every search, ES\|QL, SQL, or EQL query for analysis and debugging.	The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview since 9.4 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Slow query and index logging in Elasticsearch	Identify slow queries and indexing operations.	The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

If query logging is not available in your Elastic Stack version, HTTP request body auditing can also capture submitted queries.

Audit logging

Audit logging tracks security-related events such as authentication attempts, authorization decisions, and configuration changes.

Stack audit logging records security events inside your cluster. Cloud audit trail records organization-level actions around your deployments. On FedRAMP environments, use both for full coverage.

Feature	Description	Availability
Stack security event audit logging	Enable and configure audit logging for Elasticsearch and Kibana deployments. Captures security events such as authentication, authorization, and configuration changes.	The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Elastic Cloud audit trail	Audit organization-level actions such as sign-in activity, deployment management, user and role changes, and API key usage.	Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. FedRAMP Moderate only
Log delivery in Elastic Cloud Serverless	Deliver logs from a Serverless project to a destination project for centralized investigation and alerting. Audit trail is the first supported log type, capturing Elasticsearch and Kibana activity such as sign-ins, configuration changes, data access, and UI access.	Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Tip

Activity logs record events for later analysis. For real-time visibility into running queries, use Query activity. For real-time cluster health and performance monitoring, refer to the monitoring tools available for your deployment type.

Kibana user activity logging

Kibana user activity logging logs user actions in Kibana, such as dashboard views, creation, and updates. Unlike audit logging, which tracks security compliance events like authentication and authorization decisions, user activity logging records day-to-day interactions with Kibana. For example, you can use these logs to understand which dashboards your team relies on.