|
| 1 | + |
| 2 | +=== Logging |
| 3 | + |
| 4 | +Elasticsearch emits a number of logs, which by are placed in `ES_HOME/logs`. |
| 5 | +The default logging level is INFO. It provides a moderate amount of information, |
| 6 | +but is designed to be rather light so that your logs are not enormous. |
| 7 | + |
| 8 | +When debugging problems, particularly problems with node discovery (since this |
| 9 | +often depends on finicky network configurations), it can be helpful to bump |
| 10 | +up the logging level to DEBUG. |
| 11 | + |
| 12 | +You _could_ modify the `logging.yml` file and restart your nodes...but that is |
| 13 | +both tedious and leads to unnecessary downtime. Instead, you can update logging |
| 14 | +levels through the Cluster Settings API that we just learned about. |
| 15 | + |
| 16 | +To do so, take the logger you are interested in and prepend `logger.` to it. |
| 17 | +Let's turn up the discovery logging: |
| 18 | + |
| 19 | +[source,js] |
| 20 | +---- |
| 21 | +PUT /_cluster/settings |
| 22 | +{ |
| 23 | + "transient" : { |
| 24 | + "logger.discovery" : "DEBUG" |
| 25 | + } |
| 26 | +} |
| 27 | +---- |
| 28 | + |
| 29 | +While this setting is in effect, Elasticsearch will begin to emit DEBUG-level |
| 30 | +logs for the `discovery` module. |
| 31 | + |
| 32 | +INFORMATION: Avoid TRACE, it is extremely verbose, to the point where the logs |
| 33 | +are no longer useful. |
| 34 | + |
| 35 | +==== Slowlog |
| 36 | + |
| 37 | +There is another log called the _Slowlog_. The purpose of this log is to catch |
| 38 | +queries and indexing requests that take over a certain threshold of time. |
| 39 | +It is useful for hunting down user-generated queries that are particularly slow. |
| 40 | + |
| 41 | +By default, the slowlog is not enabled. It can be enabled by defining the action |
| 42 | +(query, fetch or index), the level that you want the event logged at (WARN, DEBUG, |
| 43 | +etc) and a time threshold. |
| 44 | + |
| 45 | +This is an index-level setting, which means it is applied to individual indices: |
| 46 | + |
| 47 | +[source,js] |
| 48 | +---- |
| 49 | +PUT /my_index/_settings |
| 50 | +{ |
| 51 | + "index.search.slowlog.threshold.query.warn" : "10s", <1> |
| 52 | + "index.search.slowlog.threshold.fetch.debug": 500ms", <2> |
| 53 | + "index.indexing.slowlog.threshold.index.info": 5s" <3> |
| 54 | +} |
| 55 | +---- |
| 56 | +<1> Emit a WARN log when queries are slower than 10s |
| 57 | +<2> Emit a DEBUG log when fetches are slower than 500ms |
| 58 | +<3> Emit an INFO log when indexing takes longer than 5s |
| 59 | + |
| 60 | +You can also define these thresholds in your `elasticsearch.yml` file. Indices |
| 61 | +that do not have a threshold set will inherit whatever is configured in the |
| 62 | +static config. |
| 63 | + |
| 64 | +Once the thresholds are set, you can toggle the logging level like any other |
| 65 | +logger: |
| 66 | + |
| 67 | +[source,js] |
| 68 | +---- |
| 69 | +PUT /_cluster/settings |
| 70 | +{ |
| 71 | + "transient" : { |
| 72 | + "logger.index.search.slowlog" : "DEBUG", <1> |
| 73 | + "logger.index.indexing.slowlog" : WARN <2> |
| 74 | + } |
| 75 | +} |
| 76 | +---- |
| 77 | +<1> Set the search slowlog to DEBUG level |
| 78 | +<2> Set the indexing slowlog to WARN level |
| 79 | + |
| 80 | + |
0 commit comments