Include client IP/host in slowlog entries

[ppf2]

Sometimes it may be helpful to be able to log the the host/IP of the end client that submitted a search or indexing request (eg. somebody has been sending these really bad queries to the cluster and we want to find out the host/IP of the offending search client application/host). Would be nice to have this as part of the slowlog entries.

[s1monw]

I agree this can be useful. It can also be useful in the context of shield to log user information who issues the request. We can forward the headers from the request to the SearchContenxt and then log it? I mean we can even go further and allow users to specify a mustache template to make up their log line here?

[cfeio]

+1 This would be very useful in troubleshooting where slow queries are coming from

[martijnvg]

+1 there is no doubt about the usefulness of this enhancement

[justinvaldez]

Please add this - It's way to hard to locate the offending bad queries at this point in time.

[sherry-ger]

+1

[seang-es]

+1

[charlesfeng]

+1

[nezhazheng]

+1

[clintongormley]

Discussed in FixItFriday - we should allow the requestor to specify a custom header (eg X-Opaque-ID) which is then logged in the search and index slow logs.

[nmeisels]

+1 This would be extremely useful

[higee]

+1

[kovyrin]

+1 for adding user IP and the opaque id to slow logs (and, maybe, the user name as well)

[IngaFeick]

+1 Really really need this, but for all logs, not just slow logs.

[lwjli]

The x-pack plugin provides similar functionality, see https://www.elastic.co/guide/en/x-pack/current/auditing.html
But it just log the client ip for some events, not slowlog.

[mylinuxsa]

+1
I need

[kevinconaway]

It looks like the X-Opaque-Id is now available in the slowlog via #31539

[pgomulka]

closing as this is being supported by x-opaque-id