---
title: Audit Elasticsearch HTTP request bodies
description: Include authenticated REST request bodies in Elasticsearch audit events for security investigations and compliance.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/monitor/stack-audit-logging/auditing-http-request-bodies
products:
  - Elastic Documentation
  - Elasticsearch
applies_to:
  - Elastic Cloud Serverless: Unavailable
  - Elastic Stack: Generally available
---

# Audit Elasticsearch HTTP request bodies
Elasticsearch can include the body of an authenticated REST request in its `authentication_success` audit event. Request bodies can contain search queries, indexing operations, security configuration changes, or payloads sent to other REST APIs.
<note applies-to="Elastic Stack: Preview since 9.4">
  To trace and analyze queries, use [query logging](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/monitor/logging-configuration/query-logs). Request body auditing can capture query payloads, but it associates the HTTP body with a security audit event and doesn't provide query-specific fields such as duration, outcome, or targeted indices. If query logging isn't available, request body auditing can help identify submitted queries.
</note>


## Include request bodies in audit events

To include request bodies, configure the following setting in Elasticsearch:
```yaml
xpack.security.audit.logfile.events.emit_request_body: true
```

You can apply this setting through [cluster update settings API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cluster-put-settings), as described in [Configure audit logging](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/monitor/stack-audit-logging/configuring-audit-logs). Alternatively, you can modify [`elasticsearch.yml`](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/stack-settings) in all nodes and restart for the changes to take effect.
The request body is available only on the `authentication_success` event generated by the REST layer on the coordinating node. This event isn't included by default. Add `authentication_success` to the existing `xpack.security.audit.logfile.events.include` list to capture request bodies while preserving the other event types that you audit.
<important>
  Request bodies can contain sensitive data. Although Elasticsearch filters credentials from audited security APIs, other sensitive data might be recorded in plain text. A request body can also contain malicious content that breaks a parser consuming the audit logs.
</important>


## Request body fields

How Elasticsearch records the request body depends on its content type:
<definitions>
  <definition term="request.body">
    For request bodies that Elasticsearch can represent as JSON, contains the full body as an escaped JSON string. Elasticsearch converts supported structured formats, such as YAML, to JSON. If you collect audit logs with the Elasticsearch integration or the Filebeat Elasticsearch module, the ingest pipeline maps `request.body` to the Elastic Common Schema (ECS) field `http.request.body.content` in indexed documents.
  </definition>
  <definition term="request.raw_body Elastic Stack: Generally available since 9.4">
    Contains the request body as a Base64-encoded string when Elasticsearch can't represent it as JSON, such as for Protobuf telemetry payloads. Elasticsearch emits this field instead of `request.body`. The audit event records the content type in `request.raw_body_content_type`. If the request specifies a content encoding, the audit event records it in `request.raw_body_content_encoding`.
  </definition>
</definitions>

For complete field descriptions, refer to [audit event types](https://docs-v3-preview.elastic.dev/elastic/elasticsearch/tree/main/reference/elasticsearch/elasticsearch-audit-events).