elastic / elastic/docs-content

Reframe 'Audit Elasticsearch search queries' now that query logging exists

Open
#6,203 1 comment 0 reactions 0 assignees View on GitHub
Team:Admin Team:Developer
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 12h
Merged PRs (30d)
116

Description

## Context

Raised in https://github.com/elastic/docs-content/pull/5039#issuecomment-4341782933.

**Impacted page:** https://www.elastic.co/docs/deploy-manage/security/logging-configuration/auditing-search-queries

**Related PR:** https://github.com/elastic/docs-content/pull/5039 (query logging)

## Problem

Now that query logging provides an official way to trace search queries and tie them to a user, the "Audit Elasticsearch search queries" page is misleading. The audit feature described on that page actually surfaces **any request body**, not only search query payloads. With query logging available, we should no longer position audit logging as the way to trace search queries.

## Definition of done

- Rename the page to something more generic like "Audit Elasticsearch HTTP payloads"
- Remove search-query-specific framing from the content
- Point readers to query logging as the recommended approach for tracing search queries

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.