elasticsearch能记录每次的查询吗

记录用户查询日志有两种方案1. 编写插件(实现比较简单)，将查询日志记录到es日志文件中，示例代码如

public class SearchLoggerPlugin extends Plugin {



	@Override

	public String name() {

		return "requestLogger";

	}



	@Override

	public String description() {

		return "attempt to log search request through TCP.";

	}



	public void onModule(final ActionModule module) {

		module.registerFilter(SearchRequestActionFilter.class);

	}

}



public class SearchRequestActionFilter extends ActionFilter.Simple {



	private final ESLogger tcpSearchLogger;



	private static final String INDEX_TCP_SEARCH_LOG_PREFIX = "index.tcp.search.log";



	@Inject

	public SearchRequestActionFilter(Settings settings) {

		super(settings);

		this.tcpSearchLogger = Loggers.getLogger(INDEX_TCP_SEARCH_LOG_PREFIX);

	}



	@Override

	public int order() {

		return 0;

	}



	@SuppressWarnings("rawtypes")

	@Override

	public boolean apply(String action, ActionRequest actionRequest,

			final ActionListener listener) {

		tcpSearchLogger.info("request info....");

		return true;

	}

	

	@SuppressWarnings("rawtypes")

	@Override

	public boolean apply(String s, ActionResponse actionResponse,

			ActionListener actionListener) {

	    tcpSearchLogger.info("response info....");

		return true;

	}

}

2. 实现查询网关，可以扩展审计限流，记录日志，故障迁移等功能。需要仿照es网络通信源码实现网关(实现较复杂)。

我们是服务层记录查询语句。说白了就是肯定你有个服务或者 应用去调用查询语句，在那个服务或者应用中把query dsl 通过日志打下来就行了

/{index}/_stats/search命令可以返回一些search的统计数据。如果定时执行，可以看出一些查询性能的问题。

# curl -XGET '192.168.1.111:9200/log_test1/_stats/search?pretty'
{
  "_shards" : {
    "total" : 12,
    "successful" : 12,
    "failed" : 0
  },
  "_all" : {
    "primaries" : {
      "search" : {
        "open_contexts" : 0,
        "query_total" : 1,
        "query_time_in_millis" : 0,
        "query_current" : 0,
        "fetch_total" : 0,
        "fetch_time_in_millis" : 0,
        "fetch_current" : 0,
        "scroll_total" : 0,
        "scroll_time_in_millis" : 0,
        "scroll_current" : 0
      }
    },
    "total" : {
      "search" : {
        "open_contexts" : 0,
        "query_total" : 4,
        "query_time_in_millis" : 0,
        "query_current" : 0,
        "fetch_total" : 0,
        "fetch_time_in_millis" : 0,
        "fetch_current" : 0,
        "scroll_total" : 0,
        "scroll_time_in_millis" : 0,
        "scroll_current" : 0
      }
    }
  },
  "indices" : {
    "log_test1" : {
      "primaries" : {
        "search" : {
          "open_contexts" : 0,
          "query_total" : 1,
          "query_time_in_millis" : 0,
          "query_current" : 0,
          "fetch_total" : 0,
          "fetch_time_in_millis" : 0,
          "fetch_current" : 0,
          "scroll_total" : 0,
          "scroll_time_in_millis" : 0,
          "scroll_current" : 0
        }
      },
      "total" : {
        "search" : {
          "open_contexts" : 0,
          "query_total" : 4,
          "query_time_in_millis" : 0,
          "query_current" : 0,
          "fetch_total" : 0,
          "fetch_time_in_millis" : 0,
          "fetch_current" : 0,
          "scroll_total" : 0,
          "scroll_time_in_millis" : 0,
          "scroll_current" : 0
        }
      }
    }
  }
}

es有类似慢查询的日志，可以配置，打印到日志。