elasticsearch开启慢日志记录

简介：
elasticsearch的慢日志包括查询慢日志和索引慢日志，默认是没有开启慢日志记录的，需要我们手动开启。

开启慢日志记录
开启慢日志的方法，可以通过修改配置文件然后重启修改，或者通过API修改，这里在Kibana使用API修改。

# 检查是否开启慢日志记录
GET /test/_settings


# 开启查询慢日志记录
PUT /test/_settings
{
     
    "index.search.slowlog.threshold.query.warn": "1000ms",
    "index.search.slowlog.threshold.query.info": "500ms",
    "index.search.slowlog.threshold.query.debug": "800ms",
    "index.search.slowlog.threshold.query.trace": "200ms",
    "index.search.slowlog.threshold.fetch.warn": "1000ms",
    "index.search.slowlog.threshold.fetch.info": "500ms",
    "index.search.slowlog.threshold.fetch.debug": "800ms",
    "index.search.slowlog.threshold.fetch.trace": "200ms",
    "index.search.slowlog.level": debug
}

# 开启索引慢日志记录
PUT /test/_settings
{
     
    "index.indexing.slowlog.threshold.index.warn": "1000ms",
    "index.indexing.slowlog.threshold.index.info": "500ms",
    "index.indexing.slowlog.threshold.index.debug": "500ms",
    "index.indexing.slowlog.threshold.index.trace": "500ms",
    "index.indexing.slowlog.level": debug,
    "index.indexing.slowlog.source": 1000
}

注意：这里是在测试，数据量比较少，所以门限比较低，生产环境根据数据量灵活修改。

关闭慢日志记录
如果关闭设置，只需要赋值为 null 即可，null不加引号，否则会认为是字符串。

PUT /test/_settings
{
     
    "index.indexing.slowlog.threshold.index.warn": null,
    "index.indexing.slowlog.threshold.index.info": null,
    "index.indexing.slowlog.threshold.index.debug": null,
    "index.indexing.slowlog.threshold.index.trace": null,
    "index.indexing.slowlog.level": null,
    "index.indexing.slowlog.source": null
}