One liner to expose the EQL query for debugging for users (elastic#10…

…0565) ## Summary Expose the EQL query in the Kibana logs for detections when they are being run when Kibana in debug mode.
ecezalp · May 26, 2021 · 86ac550 · 86ac550
1 parent 4c6ca64
commit 86ac550
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/eql.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/eql.ts
@@ -92,6 +92,11 @@ export const eqlExecutor = async ({
     ruleParams.eventCategoryOverride
   );
   const eqlSignalSearchStart = performance.now();
+  logger.debug(
+    `EQL query request path: ${request.path}, method: ${request.method}, body: ${JSON.stringify(
+      request.body
+    )}`
+  );
   // TODO: fix this later
   const { body: response } = (await services.scopedClusterClient.asCurrentUser.transport.request(
     request