elasticsearch - 为什么我在Elasticsearch中没有跟踪日志？

Question

嘿有人可以帮我为什么我没有得到运输级跟踪日志。这在我当前的/ _cluster / settings中

{ 
  "persistent": { 
    "xpack": { 
      "monitoring": { 
        "collection": { 
          "enabled": "true" 
        } 
      } 
    }, 
    "logger": { 
      "index": { 
        "indexing": { 
          "slowlog": "WARN" 
        }, 
        "search": { 
          "slowlog": "WARN" 
        } 
      } 
    } 
  }, 
  "transient": { 
    "cluster": { 
      "routing": { 
        "allocation": { 
          "enable": "all" 
        } 
      }, 
      "service": { 
        "slow_task_logging_threshold": "30s" 
      } 
    }, 
    "indices": { 
      "recovery": { 
        "max_bytes_per_sec": "500mb" 
      } 
    }, 
    "logger": { 
      "_root": "WARN", 
      "index": { 
        "indexing": { 
          "slowlog": "WARN" 
        }, 
        "search": { 
          "slowlog": "WARN" 
        } 
      }, 
      "org": { 
        "elasticsearch": { 
          "TransportService": { 
            "tracer": "TRACE" 
          }, 
          "transport": "TRACE" 
        } 
      } 
    } 
  } 
}

我在40个节点的集群上运行6.5.2的elasticsearch版本。
任何帮助表示赞赏，谢谢。
我尝试过动态更改设置，根据我的理解，难道不应该为传输级别提供跟踪日志并为其他所有警告日志吗？

Answer 1

对于运输，您可能需要指定包含字段

"transient" : {
  "transport.tracer.include" : "*",

对于搜索/索引WARN日志，请指定WARN时间

https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules-slowlog.html