# Add username to log statements

**URL:** <https://forum.search-guard.com/t/add-username-to-log-statements/1877>\
**Category:** Search Guard\
**Created:** [June 29, 2020, 12:09pm UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877 "2020-06-29T12:09:40Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [June 29, 2020, 12:09pm UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/1 "2020-06-29T12:09:40Z")

</div>

**Elasticsearch version:**  
7.7.1  
**Server OS version:**  
Centos 7  
**Kibana version (if relevant):**

**Browser version (if relevant):**

**Browser OS version (if relevant):**

**Describe the issue:**  
I can’t add user to search slow log… I have configured log4j2.properties as describe here [Search Guard logging | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/troubleshooting-setting-log-level) but user is not looged to index\_search\_slowlog.log  
**Steps to reproduce:**

1. Update index settings and set level slow search
2. Add appender.index\_search\_slowlog\_rolling\_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%{user}] [%x{user}] [%node\_name] %marker %m%n to log4j2.properties
3. Run some searches to generate slow log

**Expected behavior:**  
User added to index\_search\_slowlog.log

**Provide configuration:**  
/etc/elasticsearch/log4j2.properties

```auto
#################################################
#################################################
######## Search slowlog - old style pattern ####
appender.index_search_slowlog_rolling_old.type = RollingFile
appender.index_search_slowlog_rolling_old.name = index_search_slowlog_rolling_old
appender.index_search_slowlog_rolling_old.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}\
  _index_search_slowlog.log
appender.index_search_slowlog_rolling_old.layout.type = PatternLayout
appender.index_search_slowlog_rolling_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%{user}] [%x{user}] [%node_name] %marker %m%n

appender.index_search_slowlog_rolling_old.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}\
  _index_search_slowlog-%i.log.gz
appender.index_search_slowlog_rolling_old.policies.type = Policies
appender.index_search_slowlog_rolling_old.policies.size.type = SizeBasedTriggeringPolicy
appender.index_search_slowlog_rolling_old.policies.size.size = 1GB
appender.index_search_slowlog_rolling_old.strategy.type = DefaultRolloverStrategy
appender.index_search_slowlog_rolling_old.strategy.max = 4
#################################################

```

index setting  
“index.search.slowlog.threshold.query.warn”: “10s”,  
“[index.search.slowlog.threshold.query.info](http://index.search.slowlog.threshold.query.info)”: “1ms”,  
“index.search.slowlog.threshold.query.debug”: “2s”,  
“index.search.slowlog.threshold.query.trace”: “500ms”,  
“index.search.slowlog.threshold.fetch.warn”: “1s”,  
“[index.search.slowlog.threshold.fetch.info](http://index.search.slowlog.threshold.fetch.info)”: “1ms”,  
“index.search.slowlog.threshold.fetch.debug”: “500ms”,  
“index.search.slowlog.threshold.fetch.trace”: “200ms”,  
“index.search.slowlog.level”: “info”

**Provide logs:**  
ndex\_search\_slowlog.log

```auto
[2020-06-29T12:05:56,346][INFO][i.s.s.query] [%{user}] [[]] [esdata1] [kibana_sample_data_flights][0] took[9.9ms], took_millis[9], total_hits[62 hits], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[1], source[{"size":0,"query":{"bool":{"filter":[{"match_all":{"boost":1.0}},{"range":{"timestamp":{"from":"2020-06-28T12:05:56.258Z","to":"2020-06-29T12:05:56.258Z","include_lower":true,"include_upper":true,"format":"strict_date_optional_time","boost":1.0}}}],"must_not":[{"match_phrase":{"FlightDelayMin":{"query":0,"slop":0,"zero_terms_query":"NONE","boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}},"_source":{"includes":[],"excludes":[]},"stored_fields":"*","docvalue_fields":[{"field":"timestamp","format":"date_time"}],"script_fields":{"hour_of_day":{"script":{"source":"doc['timestamp'].value.hourOfDay","lang":"painless"},"ignore_failure":false}},"aggregations":{"2":{"histogram":{"field":"FlightDelayMin","interval":30.0,"offset":0.0,"order":{"_key":"asc"},"keyed":false,"min_doc_count":1}}}}], id[],
[2020-06-29T12:05:56,348][INFO][i.s.s.fetch] [%{user}] [[]] [esdata1] [kibana_sample_data_flights][0] took[2.2ms], took_millis[2], total_hits[62 hits], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[1], source[{"size":0,"query":{"bool":{"filter":[{"match_all":{"boost":1.0}},{"range":{"timestamp":{"from":"2020-06-28T12:05:56.258Z","to":"2020-06-29T12:05:56.258Z","include_lower":true,"include_upper":true,"format":"strict_date_optional_time","boost":1.0}}}],"must_not":[{"match_phrase":{"FlightDelayMin":{"query":0,"slop":0,"zero_terms_query":"NONE","boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}},"_source":{"includes":[],"excludes":[]},"stored_fields":"*","docvalue_fields":[{"field":"timestamp","format":"date_time"}],"script_fields":{"hour_of_day":{"script":{"source":"doc['timestamp'].value.hourOfDay","lang":"painless"},"ignore_failure":false}},"aggregations":{"2":{"histogram":{"field":"FlightDelayMin","interval":30.0,"offset":0.0,"order":{"_key":"asc"},"keyed":false,"min_doc_count":1}}}}], id[],

```

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [June 30, 2020, 10:41am UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/2 "2020-06-30T10:41:26Z")

</div>

I’ll try to reproduce the issue and let you know.

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [July 7, 2020, 8:06am UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/3 "2020-07-07T08:06:50Z")

</div>

Hello, have you try to reproduce issue?

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [July 8, 2020, 9:51am UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/4 "2020-07-08T09:51:35Z")

</div>

Hi. I tried this today and could reproduce the issue. I add this to the bug queue.

---

<div class="post-metadata">

**Author:** ![cstaley](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/cstaley/32/463_2.png) [@cstaley](https://forum.search-guard.com/u/cstaley)\
**Post date:** [September 2, 2020, 10:03am UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/5 "2020-09-02T10:03:21Z")

</div>

One update to this issue:

log4j patterns are case-sensitive. You need to use %X, not %x.

See also [Log4j – Log4j 2 Layouts](https://logging.apache.org/log4j/2.x/manual/layouts.html)

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [October 19, 2020, 6:42am UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/6 "2020-10-19T06:42:12Z")

</div>

Hi @cstaley,  
when i change log pattern as You wrote it should work as expected?  
br,  
Mariusz

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [October 19, 2020, 8:09am UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/7 "2020-10-19T08:09:58Z")

</div>

@marwojt Yes, it should. Did you try it?

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [October 19, 2020, 10:06am UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/8 "2020-10-19T10:06:48Z")

</div>

Not yet. I will try and let You know

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [October 21, 2020, 1:02pm UTC](https://forum.search-guard.com/t/add-username-to-log-statements/1877/9 "2020-10-21T13:02:54Z")

</div>

I tried different patterns and it doesn’t help

appender.index\_search\_slowlog\_rolling\_old.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%X{user}] [%x{user}] %X{user} %x{user} [%node\_name] %marker %m%n

[2020-10-21T12:56:58,171][INFO][i.s.s.query] [] [esdata] [kibana\_sample\_data\_logs][0] took[2.7ms], took\_millis[2], total\_hits[216 hits], types, stats, search\_type[QUERY\_THEN\_FETCH], total\_shards[1], source[{“size”:500,“query”:{“bool”:{“filter”:[{“match\_all”:{“boost”:1.0}},{“range”:{“timestamp”:{“from”:“2020-10-20T12:56:58.051Z”,“to”:“2020-10-21T12:56:58.051Z”,“include\_lower”:true,“include\_upper”:true,“format”:“strict\_date\_optional\_time”,“boost”:1.0}}}],“adjust\_pure\_negative”:true,“boost”:1.0}},“version”:true,“\_source”:{“includes”:,“excludes”:},“stored\_fields”:“_“,“docvalue\_fields”:[{“field”:”@timestamp",“format”:“date\_time”},{“field”:“timestamp”,“format”:“date\_time”},{“field”:“utc\_time”,“format”:“date\_time”}],“script\_fields”:{“hour\_of\_day”:{“script”:{“source”:“doc[‘timestamp’].value.getHour()”,“lang”:“painless”},“ignore\_failure”:false}},“sort”:[{“timestamp”:{“order”:“desc”,“unmapped\_type”:“boolean”}}],“track\_total\_hits”:2147483647,“aggregations”:{“2”:{“date\_histogram”:{“field”:“timestamp”,“time\_zone”:“Europe/Warsaw”,“fixed\_interval”:“30m”,“offset”:0,“order”:{“\_key”:“asc”},“keyed”:false,“min\_doc\_count”:1}}},“highlight”:{“pre\_tags”:[“@kibana-highlighted-field@”],“post\_tags”:[“@/kibana-highlighted-field@”],“fragment\_size”:2147483647,“fields”:{"_”:{}}}}], id,