---
title: Elasticsearch query log fields
description: Root-level fields from Elasticsearch query log JSON lines when ingested with the filestream NDJSON parser and expand_keys. 
url: https://docs-v3-preview.elastic.dev/elastic/beats/pull/50166/reference/filebeat/exported-fields-elasticsearch-querylog
products:
  - Beats
  - Filebeat
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Elasticsearch query log fields
Root-level fields from Elasticsearch query log JSON lines when ingested with the filestream NDJSON parser and expand_keys.
<definitions>
  <definition term="http.request.headers.x_opaque_id">
    Value of the X-Opaque-Id HTTP header when nested under http.request.headers in ECS-style logs.
    type: keyword
  </definition>
  <definition term="user.realm">
    Authentication realm for the user in Elasticsearch structured logging.
    type: keyword
  </definition>
  <definition term="auth.type">
    Authentication mechanism (TOKEN, REALM, API_KEY, and so on) from Elasticsearch structured logging.
    type: keyword
  </definition>
</definitions>