User query data is stored in elasticsearch with the index name querylogs, it can be viewed by accessing [https://localhost:9200/_cat/indices](🔗).


The data related to queries in the index can be accessed here [https://localhost:9200/querylogs/_search?pretty=true](🔗).


## **Viewing Queries in Kibana**

  • Kibana can be used to view and search queries from querylogs index in elasticsearch, and generate reports based on the queries.

  • The index name that has to be added in the Kibana settings is **querylogs**.




You can search and generate reports after adding the querylogs index in Kibana.


To get to know more about Kibana in SearchBlox please check the link: [Kibana Visualizations](🔗)

## **Deleting or clearing data from querylog index**

Data in the querylog index or the search queries stored in elasticsearch index can be deleted from Kibana using Dev Tools by sending a clear request to elasticsearch.

  • Go to Kibana and access Dev Tools


  • Give the following POST request to clear all the data from querylogs index.

  • If you want to delete using date range then give the POST request with date range as shown.

The response would be:


## **Viewing Queries From Logs**

The following log files contain the entry data for searches made in SearchBlox by all users.

  • `query.log`: all search queries.

  • `data.log`: indexed data based on user searches. These log files are available here: `<SEARCHBLOX_INSTALLATION_PATH>/webapps/searchblox/logs`

Important Information:

Query logs are deleted that is, log rotation is done once every 14 days.

## **Query Suggestion Service**

For query suggestion customization, you can create a CSV file with the list of supported queries for suggestions and add the heading 'querystring' within your CSV file. Index the customized file with CSV collection using the UniqueID as 'querystring'.

Use the AutoSuggest endpoint to check with your collection name by passing 'cname' parameter. `https://localhost:8443/rest/v2/api/autocomplete?limit=5&query=lat&cname=<CSV_collection_name_here>`