<p dir="auto"><strong>Describe the feature</strong>:</p>
<p dir="auto">We would like to be able to link slow queries back to the user or application which caused the slow query.</p>
<p dir="auto">Therefore we recommend adding a "logData" parameter to the search API which is simply copied from the request directly into the slow query log. We can then put identifiers (user ID, application ID, query ID, etc.) and what-not into this field to provide the linkages necessary to perform traceback to the application / systems which caused the slow query.</p>
<p dir="auto">We realize that we could possibly do this with the "stats" parameter (stats groups), but we are concerned that there may be many IDs (thousands, millions) and that the stats-groups structure may not support such a large number of groups (i.e. it would likely use up memory maintaining stats for millions of entries).</p>
<p dir="auto">Thank you.<br>
Paul</p>
<p dir="auto">This is same problem with <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="122809781" data-permission-text="Title is private" data-url="https://github.com/elastic/elasticsearch/issues/15520" data-hovercard-type="issue" data-hovercard-url="/elastic/elasticsearch/issues/15520/hovercard" href="https://github.com/elastic/elasticsearch/issues/15520">#15520</a>.</p>
<p dir="auto">Cause of this problem is that behavior of killproc is different between RHEL 6 and 7.</p>
<p dir="auto">Line 129 of /etc/init.d/elasticsearch:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="killproc -p $pidfile -d 86400 $prog"><pre class="notranslate"><code class="notranslate">killproc -p $pidfile -d 86400 $prog
</code></pre></div>
<p dir="auto">In RHEL 6, killproc execute "sleep $delay" if target process does not stop within 1sec. So, "/etc/init.d/elasticsearch stop" often takes 86400 seconds, even if elasticsearch is stopped.</p>