在ElasticSearch中启用搜索缓慢日志

Question

如何启用弹性搜索中的缓慢搜索日志。

我正在使用ES版本5.2

我尝试运行以下命令，但这似乎不起作用。 似乎什么都没有写入文件。

PUT /articles-dev-19-06-2017-15-20-48/_settings
{
"index.search.slowlog.threshold.query.warn": "10s",
"index.search.slowlog.threshold.query.info": "5s",
"index.search.slowlog.threshold.query.debug": "2s",
"index.search.slowlog.threshold.query.trace": "500ms",
"index.search.slowlog.threshold.fetch.warn": "1s",
"index.search.slowlog.threshold.fetch.info": "800ms",
"index.search.slowlog.threshold.fetch.debug": "500ms",
"index.search.slowlog.threshold.fetch.trace": "200ms",
"index.indexing.slowlog.threshold.index.warn": "10s",
"index.indexing.slowlog.threshold.index.info": "5s",
"index.indexing.slowlog.threshold.index.debug": "2s",
"index.indexing.slowlog.threshold.index.trace": "500ms",
"index.indexing.slowlog.level": "trace",
"index.indexing.slowlog.source": "100"
}

这是索引上的设置

{
  "articles-dev-19-06-2017-15-20-48": {
    "settings": {
      "index": {
        "search": {
          "slowlog": {
            "threshold": {
              "fetch": {
                "warn": "1s",
                "trace": "200ms",
                "debug": "500ms",
                "info": "800ms"
              },
              "query": {
                "warn": "10s",
                "trace": "500ms",
                "debug": "2s",
                "info": "5s"
              }
            }
          }
        },
        "indexing": {
          "slowlog": {
            "level": "trace",
            "threshold": {
              "index": {
                "warn": "10s",
                "trace": "500ms",
                "debug": "2s",
                "info": "5s"
              }
            },
            "source": "100"
          }
        },
        "number_of_shards": "2",
        "provided_name": "advice-articles-dev-19-06-2017-15-20-48",
        "creation_date": "1497885649676",

Answer 1

Elasticsearch操作通常在几微秒内执行。 因此，即使您使用最激进的设置也不会捕获它们。

要测试它，您应该将警告设置设置为0秒，这将捕获所有内容：

PUT /articles-dev-19-06-2017-15-20-48/_settings
{"index.search.slowlog.threshold.query.warn": "0s",
"index.search.slowlog.threshold.fetch.warn": "0s",
"index.indexing.slowlog.threshold.index.warn": "0s"
}

之后检查您的日志。 如果他们开始填满，您将知道它正在工作。

在您满意它可以工作之后，只需将其设置回您希望它可以长期运行的值即可。 例：

PUT /articles-dev-19-06-2017-15-20-48/_settings
{"index.search.slowlog.threshold.query.warn": "10s",
"index.search.slowlog.threshold.fetch.warn": "10s",
"index.indexing.slowlog.threshold.index.warn": "10s"
}

Answer 2

可能是您运行的查询不够慢，无法记录它们。 -您可以将设置更改为1ms，看看是否有帮助。 我尝试了这些设置，并且对我有用。

尝试使用一些随机通配符查询：

{“ query”：{“ bool”：{“ must”：{“ wildcard”：{“ message”：“ * 123 *”}}}}}