elasticsearch(1) 生产环境不宕机配置慢查询日志。

ES慢查询日志开启，可以通过。

index.search.slowlog.threshold.query.warn: 10s
index.search.slowlog.threshold.query.info: 4s
index.search.slowlog.threshold.query.debug: 2s
index.search.slowlog.threshold.query.trace: 500ms
index.search.slowlog.threshold.fetch.warn: 1s
index.search.slowlog.threshold.fetch.info: 800ms
index.search.slowlog.threshold.fetch.debug: 500ms
index.search.slowlog.threshold.fetch.trace: 200ms

在elasticsearch.yml 中添加上面配置，然后自动开启了，因为log4j中已经默认添加了配置。

现在官方推荐做法

PUT _cluster/settings
{
  "transient" : {
        "index.search.slowlog.threshold.query.warn": "5s"
    }
}

报错：

{
  "error": {
    "root_cause": [
      {
        "type": "remote_transport_exception",
        "reason": "[hadoop5][192.168.189.134:9300][cluster:admin/settings/update]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "transient setting [index.search.slowlog.threshold.query.warn], not dynamically updateable"
  },
  "status": 400
}

经过查询elasticsearch  github 正确的做法是

PUT  _settings
{
    
       "index.search.slowlog.threshold.query.warn": "5s",
        "index.search.slowlog.threshold.query.info": "2s",
        "index.search.slowlog.threshold.query.debug": "1s",
        "index.search.slowlog.threshold.query.trace": "400ms",
        "index.search.slowlog.threshold.fetch.warn": "1s",
        "index.search.slowlog.threshold.fetch.info": "800ms",
        "index.search.slowlog.threshold.fetch.debug": "500ms",         

 "index.search.slowlog.threshold.fetch.trace": "200ms"

   
}

测试就能够观察到查询慢查询日志。

[presto@hadoopslave12 logs]$ tail -f   datamart-es_index_search_slowlog.log

[2017-10-16T09:46:34,263][TRACE][index.search.slowlog.query] [hadoopslave12] [ulc_debtor_base_info2017101310][2] took[14.3ms], took_millis[14], types[ulc_debtor_base_info2017101310], stats[], search_type[DFS_QUERY_THEN_FETCH], total_shards[5], source[{"from":1,"size":1,"query":{"bool":{"filter":[{"bool":{"must":[{"range":{"repaying_product":{"from":0,"to":null,"include_lower":false,"include_upper":true,"boost":1.0}}}],"disable_coord":false,"adjust_pure_negative":true,"boost":1.0}}],"disable_coord":false,"adjust_pure_negative":true,"boost":1.0}},"_source":{"includes":["mid"],"excludes":[]},"sort":[{"mid":{"order":"desc"}}]}], 
[2017-10-16T09:46:34,814][TRACE][index.search.slowlog.query] [hadoopslave12] [ulc_debtor_base_info2017101310][2] took[18.8ms], took_millis[18], types[ulc_debtor_base_info2017101310], stats[], search_type[DFS_QUERY_THEN_FETCH], total_shards[5], source[{"from":22,"size":1,"query":{"bool":{"filter":[{"bool":{"must":[{"range":{"repaying_product":{"from":0,"to":null,"include_lower":false,"include_upper":true,"boost":1.0}}}],"disable_coord":false,"adjust_pure_negative":true,"boost":1.0}}],"disable_coord":false,"adjust_pure_negative":true,"boost":1.0}},"_source":{"includes":["mid"],"excludes":[]},"sort":[{"mid":{"order":"desc"}}]}], 

同样慢写入日志也是类似更新！