啓用搜索緩慢登錄ElasticSearch

Question

如何在彈性搜索中啓用搜索慢日誌。

我使用ES 5.2版本

我試圖運行下面的命令，但是這似乎並不奏效。似乎沒有任何東西寫入文件。

PUT /articles-dev-19-06-2017-15-20-48/_settings 
{ 
"index.search.slowlog.threshold.query.warn": "10s", 
"index.search.slowlog.threshold.query.info": "5s", 
"index.search.slowlog.threshold.query.debug": "2s", 
"index.search.slowlog.threshold.query.trace": "500ms", 
"index.search.slowlog.threshold.fetch.warn": "1s", 
"index.search.slowlog.threshold.fetch.info": "800ms", 
"index.search.slowlog.threshold.fetch.debug": "500ms", 
"index.search.slowlog.threshold.fetch.trace": "200ms", 
"index.indexing.slowlog.threshold.index.warn": "10s", 
"index.indexing.slowlog.threshold.index.info": "5s", 
"index.indexing.slowlog.threshold.index.debug": "2s", 
"index.indexing.slowlog.threshold.index.trace": "500ms", 
"index.indexing.slowlog.level": "trace", 
"index.indexing.slowlog.source": "100" 
} 

下面是對指數

{ 
    "articles-dev-19-06-2017-15-20-48": { 
    "settings": { 
     "index": { 
     "search": { 
      "slowlog": { 
      "threshold": { 
       "fetch": { 
       "warn": "1s", 
       "trace": "200ms", 
       "debug": "500ms", 
       "info": "800ms" 
       }, 
       "query": { 
       "warn": "10s", 
       "trace": "500ms", 
       "debug": "2s", 
       "info": "5s" 
       } 
      } 
      } 
     }, 
     "indexing": { 
      "slowlog": { 
      "level": "trace", 
      "threshold": { 
       "index": { 
       "warn": "10s", 
       "trace": "500ms", 
       "debug": "2s", 
       "info": "5s" 
       } 
      }, 
      "source": "100" 
      } 
     }, 
     "number_of_shards": "2", 
     "provided_name": "advice-articles-dev-19-06-2017-15-20-48", 
     "creation_date": "1497885649676", 

Answer 1

的設置可能是你正在運行的不慢，足以記錄它們的查詢。 - 您可以將設置更改爲1ms，看看是否有幫助。我試過這些設置，它爲我工作。

一些隨機通配符查詢嘗試：

{ 「查詢」：{ 「布爾」：{ 「必須」：{ 「通配符」：{ 「消息」：「* 123 * 「 }} }}}

Answer 2

Elasticsearch操作通常執行以微秒。因此，即使採用最積極的設置也不會捕獲它們。

爲了測試它，你應該設置你的提醒設置爲0秒，這將捕獲一切：

PUT /articles-dev-19-06-2017-15-20-48/_settings 
{"index.search.slowlog.threshold.query.warn": "0s", 
"index.search.slowlog.threshold.fetch.warn": "0s", 
"index.indexing.slowlog.threshold.index.warn": "0s" 
} 

檢查你的日誌後。如果他們開始填補，你會知道它正在工作。

在你感到滿意之後，只需將它設置回你希望它長期運行的值即可。例如：

PUT /articles-dev-19-06-2017-15-20-48/_settings 
{"index.search.slowlog.threshold.query.warn": "10s", 
"index.search.slowlog.threshold.fetch.warn": "10s", 
"index.indexing.slowlog.threshold.index.warn": "10s" 
}