ElasticSearch之Slow Log

ElasticSearch的慢日志，相关的参数及配置方法。
在log4j2.properties中配置慢日志的输出文件名。

Search Slow Log

相关参数

index.search.slowlog.threshold.query.warn
index.search.slowlog.threshold.query.info
index.search.slowlog.threshold.query.debug
index.search.slowlog.threshold.query.trace
index.search.slowlog.threshold.fetch.warn
index.search.slowlog.threshold.fetch.info
index.search.slowlog.threshold.fetch.debug
index.search.slowlog.threshold.fetch.trace

上述参数的默认值均为-1，即关闭日志的输出。

参数值为时长，单位如下：

s，即秒，样例：10s。
ms，即毫秒，样例：10ms。

修改各参数的时长，命令样例，如下：

curl -X PUT "https://localhost:9200/testindex_001/_settings?pretty" -H 'Content-Type: application/json' -d'
{"index.search.slowlog.threshold.query.warn": "10s","index.search.slowlog.threshold.query.info": "5s","index.search.slowlog.threshold.query.debug": "2s","index.search.slowlog.threshold.query.trace": "500ms","index.search.slowlog.threshold.fetch.warn": "1s","index.search.slowlog.threshold.fetch.info": "800ms","index.search.slowlog.threshold.fetch.debug": "500ms","index.search.slowlog.threshold.fetch.trace": "200ms"
}
' --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

执行结果的样例，如下：

{"acknowledged" : true
}

查看上述参数的当前值，命令样例，如下：

curl -X GET "https://localhost:9200/testindex_001/_settings?pretty" --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

执行结果的样例，如下：

{"testindex_001" : {"settings" : {"index" : {"routing" : {"allocation" : {"include" : {"_tier_preference" : "data_content"}}},"search" : {"slowlog" : {"threshold" : {"fetch" : {"warn" : "1s","trace" : "200ms","debug" : "500ms","info" : "800ms"},"query" : {"warn" : "10s","trace" : "500ms","debug" : "2s","info" : "5s"}}}},"number_of_shards" : "1","provided_name" : "testindex_001","merge" : {"scheduler" : {"max_thread_count" : "2"}},"creation_date" : "1701354456991","number_of_replicas" : "1","uuid" : "7iGJRFfxRd2jD3qP-KDRmQ","version" : {"created" : "8500003"}}}}
}

Index Slow log

相关参数
index.indexing.slowlog.threshold.index.warn
index.indexing.slowlog.threshold.index.info
index.indexing.slowlog.threshold.index.debug
index.indexing.slowlog.threshold.index.trace
上述参数的默认值均为-1，即关闭日志的输出。

参数值为时长，单位如下：

s，即秒，样例：10s。
ms，即毫秒，样例：10ms。

index.indexing.slowlog.source，指定在日志中记录数据中_source时的长度，默认值为1000。

false或者0，记录日志时跳过_source字段。
true，记录日志时完整记录_source字段。
非零值，记录日志时截取_source字段的部分。

index.indexing.slowlog.reformat，输出日志时，对_source做格式化操作，默认值为true。

true，对_source做格式化操作。
false，不对_source做格式化操作。

修改各参数的时长，命令样例，如下：

curl -X PUT "https://localhost:9200/testindex_001/_settings?pretty" -H 'Content-Type: application/json' -d'
{"index.indexing.slowlog.threshold.index.warn": "10s","index.indexing.slowlog.threshold.index.info": "5s","index.indexing.slowlog.threshold.index.debug": "2s","index.indexing.slowlog.threshold.index.trace": "500ms","index.indexing.slowlog.source": "1000"
}
' --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

执行结果的样例，如下：

{"acknowledged" : true
}

查看上述参数的当前值，命令样例，如下：

curl -X GET "https://localhost:9200/testindex_001/_settings?pretty" --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

执行结果的样例，如下：

{"testindex_001" : {"settings" : {"index" : {"routing" : {"allocation" : {"include" : {"_tier_preference" : "data_content"}}},"indexing" : {"slowlog" : {"threshold" : {"index" : {"warn" : "10s","trace" : "500ms","debug" : "2s","info" : "5s"}},"source" : "1000"}},"number_of_shards" : "1","provided_name" : "testindex_001","merge" : {"scheduler" : {"max_thread_count" : "2"}},"creation_date" : "1701354456991","number_of_replicas" : "1","uuid" : "7iGJRFfxRd2jD3qP-KDRmQ","version" : {"created" : "8500003"}}}}
}

控制日志级别

从前述配置方法可以发现，当前慢日志没有提供参数用于控制日志级别。
但可以通过关闭低级别的日志，从而模拟对日志级别的控制。
比如当前只希望记录INFO级别以上的日志，则可以执行如下日志，关闭debug和trace。

curl -X PUT "https://localhost:9200/testindex_001/_settings?pretty" -H 'Content-Type: application/json' -d'
{"index.indexing.slowlog.threshold.index.debug": "-1","index.indexing.slowlog.threshold.index.trace": "-1"
}
' --cacert $ES_HOME/config/certs/http_ca.crt -u "elastic:ohCxPH=QBE+s5=*lo7F9"

相关资料