ElasticSearch之Slow Log

ElasticSearch的慢日志，相关的参数及配置方法。
在log4j2.properties中配置慢日志的输出文件名。

Search Slow Log

相关参数

• index.search.slowlog.threshold.query.warn
• index.search.slowlog.threshold.query.info
• index.search.slowlog.threshold.query.debug
• index.search.slowlog.threshold.query.trace
• index.search.slowlog.threshold.fetch.warn
• index.search.slowlog.threshold.fetch.info
• index.search.slowlog.threshold.fetch.debug
• index.search.slowlog.threshold.fetch.trace

上述参数的默认值均为-1，即关闭日志的输出。

参数值为时长，单位如下：

• s，即秒，样例：10s。
• ms，即毫秒，样例：10ms。

修改各参数的时长，命令样例，如下：

curl -X PUT "https://localhost:9200/testindex_001/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index.search.slowlog.threshold.query.warn": "10s",
  "index.search.slowlog.threshold.query.info": "5s",
  "index.search.slowlog.threshold.query.debug": "2s",
  "index.search.slowlog.threshold.query.trace": "500ms",
  "index.search.slowlog.threshold.fetch.warn": "1s",
  "index.search.slowlog.threshold.fetch.info": "800ms",
  "index.search.slowlog.threshold.fetch.debug": "500ms",
  "index.search.slowlog.threshold.fetch.trace": "200ms"
}
' --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

执行结果的样例，如下：

{
  "acknowledged" : true
}

查看上述参数的当前值，命令样例，如下：

curl -X GET "https://localhost:9200/testindex_001/_settings?pretty" --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

执行结果的样例，如下：

{
  "testindex_001" : {
    "settings" : {
      "index" : {
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "search" : {
          "slowlog" : {
            "threshold" : {
              "fetch" : {
                "warn" : "1s",
                "trace" : "200ms",
                "debug" : "500ms",
                "info" : "800ms"
              },
              "query" : {
                "warn" : "10s",
                "trace" : "500ms",
                "debug" : "2s",
                "info" : "5s"
              }
            }
          }
        },
        "number_of_shards" : "1",
        "provided_name" : "testindex_001",
        "merge" : {
          "scheduler" : {
            "max_thread_count" : "2"
          }
        },
        "creation_date" : "1701354456991",
        "number_of_replicas" : "1",
        "uuid" : "7iGJRFfxRd2jD3qP-KDRmQ",
        "version" : {
          "created" : "8500003"
        }
      }
    }
  }
}

Index Slow log

相关参数
index.indexing.slowlog.threshold.index.warn
index.indexing.slowlog.threshold.index.info
index.indexing.slowlog.threshold.index.debug
index.indexing.slowlog.threshold.index.trace
上述参数的默认值均为-1，即关闭日志的输出。

参数值为时长，单位如下：

• s，即秒，样例：10s。
• ms，即毫秒，样例：10ms。

index.indexing.slowlog.source，指定在日志中记录数据中_source时的长度，默认值为1000。

• false或者0，记录日志时跳过_source字段。
• true，记录日志时完整记录_source字段。
• 非零值，记录日志时截取_source字段的部分。

index.indexing.slowlog.reformat，输出日志时，对_source做格式化操作，默认值为true。

• true，对_source做格式化操作。
• false，不对_source做格式化操作。

修改各参数的时长，命令样例，如下：

curl -X PUT "https://localhost:9200/testindex_001/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index.indexing.slowlog.threshold.index.warn": "10s",
  "index.indexing.slowlog.threshold.index.info": "5s",
  "index.indexing.slowlog.threshold.index.debug": "2s",
  "index.indexing.slowlog.threshold.index.trace": "500ms",
  "index.indexing.slowlog.source": "1000"
}
' --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

执行结果的样例，如下：

{
  "acknowledged" : true
}

查看上述参数的当前值，命令样例，如下：

curl -X GET "https://localhost:9200/testindex_001/_settings?pretty" --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

执行结果的样例，如下：

{
  "testindex_001" : {
    "settings" : {
      "index" : {
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "indexing" : {
          "slowlog" : {
            "threshold" : {
              "index" : {
                "warn" : "10s",
                "trace" : "500ms",
                "debug" : "2s",
                "info" : "5s"
              }
            },
            "source" : "1000"
          }
        },
        "number_of_shards" : "1",
        "provided_name" : "testindex_001",
        "merge" : {
          "scheduler" : {
            "max_thread_count" : "2"
          }
        },
        "creation_date" : "1701354456991",
        "number_of_replicas" : "1",
        "uuid" : "7iGJRFfxRd2jD3qP-KDRmQ",
        "version" : {
          "created" : "8500003"
        }
      }
    }
  }
}

控制日志级别

从前述配置方法可以发现，当前慢日志没有提供参数用于控制日志级别。
但可以通过关闭低级别的日志，从而模拟对日志级别的控制。
比如当前只希望记录INFO级别以上的日志，则可以执行如下日志，关闭debug和trace。

curl -X PUT "https://localhost:9200/testindex_001/_settings?pretty" -H 'Content-Type: application/json' -d'
{
  "index.indexing.slowlog.threshold.index.debug": "-1",
  "index.indexing.slowlog.threshold.index.trace": "-1"
}
' --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

相关资料

• Slow Log
• Update index settings API