为什么我没有在Elasticsearch中获取跟踪日志

Question

嘿，有人能帮我解释一下为什么我没有得到传输级别的跟踪日志吗。这在我当前的/\ucluster/设置中

{ 
"persistent": { 
"xpack": { 
"monitoring": { 
"collection": { 
"enabled": "true" 
} 
} 
}, 
"logger": { 
"index": { 
"indexing": { 
"slowlog": "WARN" 
}, 
"search": { 
"slowlog": "WARN" 
} 
} 
} 
}, 
"transient": { 
"cluster": { 
"routing": { 
"allocation": { 
"enable": "all" 
} 
}, 
"service": { 
"slow_task_logging_threshold": "30s" 
} 
}, 
"indices": { 
"recovery": { 
"max_bytes_per_sec": "500mb" 
} 
}, 
"logger": { 
"_root": "WARN", 
"index": { 
"indexing": { 
"slowlog": "WARN" 
}, 
"search": { 
"slowlog": "WARN" 
} 
}, 
"org": { 
"elasticsearch": { 
"TransportService": { 
"tracer": "TRACE" 
}, 
"transport": "TRACE" 
} 
} 
} 
} 
}

我正在一个40节点的集群上运行6.5.2的弹性搜索版本。感谢您的帮助。我已尝试动态更改设置。根据我的理解，它不应该假设为传输级别提供跟踪日志，并为其他一切提供警告日志吗？

Answer 1

对于运输，您可能需要指定包含字段

"transient" : {
"transport.tracer.include" : "*",

对于搜索/索引警告日志，请指定警告时间

https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules-slowlog.html