Audit DQL query

OpenSearch Dashboards
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

v 2.14.0

Describe the issue:
I am using Docker to run OpenSearch and OpenSearch Dashboards. The thing I want to know is not an issue, but is there any way we can audit the DQL queries that a user runs in the ‘Discover’ tab? Even tracking the corresponding REST API call for the DQL query would be sufficient. I want to know what queries users are searching for in the ‘Discover’ tab. I know there is an audit log index created—can I add this information to it as well? If possible, it would be much more helpful. Thank you.

2

@nateynate - any ideas on this one?

3

In the audit settings, I enabled ‘audit_request_body,’ but it doesn’t contain any information about the search query or anything—it’s just empty.