在 ElasticSearch 中启用搜索慢日志

Question

如何在elasticsearch中启用搜索慢日志

我使用的是 ES 5.2 版

我已经尝试运行下面的命令，但这似乎不起作用。似乎没有任何内容写入文件。

PUT /articles-dev-19-06-2017-15-20-48/_settings
{
"index.search.slowlog.threshold.query.warn": "10s",
"index.search.slowlog.threshold.query.info": "5s",
"index.search.slowlog.threshold.query.debug": "2s",
"index.search.slowlog.threshold.query.trace": "500ms",
"index.search.slowlog.threshold.fetch.warn": "1s",
"index.search.slowlog.threshold.fetch.info": "800ms",
"index.search.slowlog.threshold.fetch.debug": "500ms",
"index.search.slowlog.threshold.fetch.trace": "200ms",
"index.indexing.slowlog.threshold.index.warn": "10s",
"index.indexing.slowlog.threshold.index.info": "5s",
"index.indexing.slowlog.threshold.index.debug": "2s",
"index.indexing.slowlog.threshold.index.trace": "500ms",
"index.indexing.slowlog.level": "trace",
"index.indexing.slowlog.source": "100"
}

这里是索引的设置

{
  "articles-dev-19-06-2017-15-20-48": {
    "settings": {
      "index": {
        "search": {
          "slowlog": {
            "threshold": {
              "fetch": {
                "warn": "1s",
                "trace": "200ms",
                "debug": "500ms",
                "info": "800ms"
              },
              "query": {
                "warn": "10s",
                "trace": "500ms",
                "debug": "2s",
                "info": "5s"
              }
            }
          }
        },
        "indexing": {
          "slowlog": {
            "level": "trace",
            "threshold": {
              "index": {
                "warn": "10s",
                "trace": "500ms",
                "debug": "2s",
                "info": "5s"
              }
            },
            "source": "100"
          }
        },
        "number_of_shards": "2",
        "provided_name": "advice-articles-dev-19-06-2017-15-20-48",
        "creation_date": "1497885649676",

Answer 1

可能是您运行的查询不够慢，无法记录它们。 - 您可以将设置更改为 1 毫秒，看看是否有帮助。我尝试了这些设置并且对我有用。

尝试使用一些随机通配符查询：

{ "query": { "bool": { "must": { "wildcard": { "message": "*123*" } } } } }

Answer 2

Elasticsearch 操作通常以微秒为单位执行。因此，即使是您最激进的设置也不会捕获它们。

要测试它，您应该将警告设置设置为 0 秒，这将捕获所有内容：

PUT /articles-dev-19-06-2017-15-20-48/_settings
{"index.search.slowlog.threshold.query.warn": "0s",
"index.search.slowlog.threshold.fetch.warn": "0s",
"index.indexing.slowlog.threshold.index.warn": "0s"
}

之后检查你的日志。如果他们开始填满，你就会知道它正在工作。

当您对它的工作感到满意后，只需将其设置回您希望它长期运行的值即可。示例：

PUT /articles-dev-19-06-2017-15-20-48/_settings
{"index.search.slowlog.threshold.query.warn": "10s",
"index.search.slowlog.threshold.fetch.warn": "10s",
"index.indexing.slowlog.threshold.index.warn": "10s"
}

在 ElasticSearch 中启用搜索慢日志

Enabling Search Slow Log in ElasticSearch

elasticsearch

elasticsearch-dsl