在ElasticSearch中启用搜索慢日志

Question

如何在弹性搜索中启用搜索慢日志。

我正在使用ES版本5.2

我尝试过运行下面的命令，但这似乎不起作用。似乎没有任何东西被写入文件。

PUT /articles-dev-19-06-2017-15-20-48/_settings
{
"index.search.slowlog.threshold.query.warn": "10s",
"index.search.slowlog.threshold.query.info": "5s",
"index.search.slowlog.threshold.query.debug": "2s",
"index.search.slowlog.threshold.query.trace": "500ms",
"index.search.slowlog.threshold.fetch.warn": "1s",
"index.search.slowlog.threshold.fetch.info": "800ms",
"index.search.slowlog.threshold.fetch.debug": "500ms",
"index.search.slowlog.threshold.fetch.trace": "200ms",
"index.indexing.slowlog.threshold.index.warn": "10s",
"index.indexing.slowlog.threshold.index.info": "5s",
"index.indexing.slowlog.threshold.index.debug": "2s",
"index.indexing.slowlog.threshold.index.trace": "500ms",
"index.indexing.slowlog.level": "trace",
"index.indexing.slowlog.source": "100"
}

以下是索引上的设置

{
  "articles-dev-19-06-2017-15-20-48": {
    "settings": {
      "index": {
        "search": {
          "slowlog": {
            "threshold": {
              "fetch": {
                "warn": "1s",
                "trace": "200ms",
                "debug": "500ms",
                "info": "800ms"
              },
              "query": {
                "warn": "10s",
                "trace": "500ms",
                "debug": "2s",
                "info": "5s"
              }
            }
          }
        },
        "indexing": {
          "slowlog": {
            "level": "trace",
            "threshold": {
              "index": {
                "warn": "10s",
                "trace": "500ms",
                "debug": "2s",
                "info": "5s"
              }
            },
            "source": "100"
          }
        },
        "number_of_shards": "2",
        "provided_name": "advice-articles-dev-19-06-2017-15-20-48",
        "creation_date": "1497885649676",

Answer 1

可能是您运行的查询不够慢，无法记录它们。-您可以将设置更改为1ms，看看这是否有帮助。我试过这些设置对我有用。

尝试使用一些随机通配符查询：

{“查询”：{ "bool"：{“必须”：{“通配符”：{“消息”："*123*“}

Answer 2

Elasticsearch操作通常在微秒内执行。因此，它们将不会被你最具侵略性的设置所捕获。

要测试它，您应该将警告设置设置为0秒，这将捕获所有内容：

PUT /articles-dev-19-06-2017-15-20-48/_settings
{"index.search.slowlog.threshold.query.warn": "0s",
"index.search.slowlog.threshold.fetch.warn": "0s",
"index.indexing.slowlog.threshold.index.warn": "0s"
}

在那之后检查你的日志。如果他们开始填补，你就会知道它是有效的。

在您满意它的工作后，只需将其设置为您希望它长期运行的值即可。示例：

PUT /articles-dev-19-06-2017-15-20-48/_settings
{"index.search.slowlog.threshold.query.warn": "10s",
"index.search.slowlog.threshold.fetch.warn": "10s",
"index.indexing.slowlog.threshold.index.warn": "10s"
}