ELK | elasticsearch开启慢日志记录

简介： elasticsearch的慢日志包括查询慢日志和索引慢日志，默认是没有开启慢日志记录的，需要我们手动开启。

开启慢日志记录 开启慢日志的方法，可以通过修改配置文件然后重启修改，或者通过API修改，这里在Kibana使用API修改。

# 检查是否开启慢日志记录 GET /test/_settings # 开启查询慢日志记录 PUT /test/_settings { "index.search.slowlog.threshold.query.warn": "1000ms", "index.search.slowlog.threshold.query.info": "500ms", "index.search.slowlog.threshold.query.debug": "800ms", "index.search.slowlog.threshold.query.trace": "200ms", "index.search.slowlog.threshold.fetch.warn": "1000ms", "index.search.slowlog.threshold.fetch.info": "500ms", "index.search.slowlog.threshold.fetch.debug": "800ms", "index.search.slowlog.threshold.fetch.trace": "200ms", "index.search.slowlog.level": debug } # 开启索引慢日志记录 PUT /test/_settings { "index.indexing.slowlog.threshold.index.warn": "1000ms", "index.indexing.slowlog.threshold.index.info": "500ms", "index.indexing.slowlog.threshold.index.debug": "500ms", "index.indexing.slowlog.threshold.index.trace": "500ms", "index.indexing.slowlog.level": debug, "index.indexing.slowlog.source": 1000 }

注意：这里是在测试，数据量比较少，所以门限比较低，生产环境根据数据量灵活修改。

关闭慢日志记录 如果关闭设置，只需要赋值为 null 即可，null不加引号，否则会认为是字符串。

PUT /test/_settings { "index.indexing.slowlog.threshold.index.warn": null, "index.indexing.slowlog.threshold.index.info": null, "index.indexing.slowlog.threshold.index.debug": null, "index.indexing.slowlog.threshold.index.trace": null, "index.indexing.slowlog.level": null, "index.indexing.slowlog.source": null }