Elasticsearch: slowlog setting in elasticsearch.yml

[obudiman]

Elasticsearch version: 5.0.0-rc1

Plugins installed: [ingest-geoip, ingest-user-agent, [email protected]]

JVM version: 1.8.0_101

OS version: 4.4.11-23.53.amzn1.x86_64

Description of the problem including expected versus actual behavior:
We're unable to set the slowlog configuration below on the elasticsearch.yml.

index.search.slowlog.threshold.query.warn: 1s
index.search.slowlog.threshold.fetch.warn: 1s
index.indexing.slowlog.threshold.index.info: 5s

The ES failed to start and the following error messages were shown:

[2016-10-13T23:33:44,363][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [elk5-rc1-node01] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: node settings must not contain any index level settings
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:116) ~[elasticsearch-5.0.0-rc1.jar:5.0.0-rc1]

There is no issue when putting the same slowlog setting directly to a particular index

Not sure if this is a bug, but the guide does mention it is possible to specify them as the default threshold on the elasticsearch.yml.

Steps to reproduce:

1. Put the slowlog setting above on elasticsearch.yml
2. Restart elasticsearch
3. Observer elasticsearch.log

[jasontedor]

These are index-level settings, 5.0.0 will not allow such to be set at the node level; the behavior here is correct. Can you say which guide you're referring to that specifies you can set these at the node level?

[obudiman]

https://www.elastic.co/guide/en/elasticsearch/reference/5.0/index-modules-slowlog.html

..Log and the thresholds are configured in the elasticsearch.yml file in the same way as the search slowlog...

If this is not allowed anymore, is there any other way we can set the slowlog globally, or maybe on multiple indices simultaneously, instead of defining it manually on each index? Having time series indices which are created daily, seem to mean we have to set the option on daily basis on the new index.

[jasontedor]

You can create a top-level template with the desired settings. These will then get applied to your daily indices. We will fix the docs.

[obudiman]

That will do. Thanks.

[jayannah]

Hi, still see the 5.6 documentation has the same settings.. and I'm getting the same error

https://www.elastic.co/guide/en/elasticsearch/reference/5.6/index-modules-slowlog.html

[2017-09-15T16:18:53,965][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: node settings must not contain any index level settings

What is t he right configuration? why such important settings are not documented corrected?