---
title: Activity logging
description: Find the right logging feature for audit, query, and performance investigation needs in your Elastic deployment.
url: https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor/activity-logging
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Documentation
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Stack: Generally available
---

# Activity logging
Activity logging records actions taken by users and systems in your Elastic environment, such as authentication events, search queries, and configuration changes. Use these logs for security auditing, compliance, debugging, and performance investigation.
<admonition title="Looking for application and component logging?">
  You can enable Elasticsearch and Kibana logging features to gain insight into Elastic Stack operations and diagnose issues. To configure these logs, refer to [Operational logging](https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor/logging-configuration).
</admonition>


## Query and performance logging

Query and performance logging helps you understand how queries perform and identify operations that need optimization. Use these logs to debug slow queries, audit search activity, and analyze indexing performance.
For search operations, query logging is the recommended approach because it captures end-to-end request duration across all query types with a single configuration. Slow logs measure shard-level execution time and are the only option for indexing operations.

| Feature                                                                                                                                                      | Description                                                            | Availability                                                |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------|-------------------------------------------------------------|
| [Query logging in Elasticsearch](https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor/logging-configuration/query-logs)               | Log every search, ES|QL, SQL, or EQL query for analysis and debugging. | <applies-to>Elastic Stack: Preview since 9.4</applies-to>   |
| [Slow query and index logging in Elasticsearch](https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor/logging-configuration/slow-logs) | Identify slow queries and indexing operations.                         | <applies-to>Elastic Stack: Generally available</applies-to> |

If query logging is not available in your Elastic Stack version, [audit logging](https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor/stack-audit-logging/enabling-audit-logs) can also capture query sources.

## Audit logging

Audit logging tracks security-related events such as authentication attempts, authorization decisions, and configuration changes.
Stack audit logging records security events inside your cluster. Cloud audit trail records organization-level actions around your deployments. On FedRAMP environments, use both for full coverage.

| Feature                                                                                                                               | Description                                                                                                                                                             | Availability                                                                             |
|---------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|
| [Stack security event audit logging](https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor/stack-audit-logging) | Enable and configure audit logging for Elasticsearch and Kibana deployments. Captures security events such as authentication, authorization, and configuration changes. | <applies-to>Elastic Stack: Generally available</applies-to>                              |
| [Elastic Cloud audit trail](https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor/cloud-audit-trail)            | Audit organization-level actions such as sign-in activity, deployment management, user and role changes, and API key usage.                                             | <applies-to>Elastic Cloud Hosted: Generally available</applies-to> FedRAMP Moderate only |

<tip>
  Activity logs record events for later analysis. For real-time visibility into running queries, use [Query activity](https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor/query-activity). For real-time cluster health and performance monitoring, refer to the [monitoring tools](https://www.elastic.co/elastic/docs-builder/docs/4384/deploy-manage/monitor) available for your deployment type.
</tip>


## Kibana user activity logging

<applies-to>
  - Elastic Stack: Preview since 9.5
</applies-to>

[Kibana user activity logging](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4384/reference/kibana/user-activity) logs user actions in Kibana, such as dashboard views, creation, and updates. Unlike audit logging, which tracks security compliance events like authentication and authorization decisions, user activity logging records day-to-day interactions with Kibana. For example, you can use these logs to understand which dashboards your team relies on.