Elasticsearch: slowlog settings should be dynamically updatable at the cluster level

Created on 1 Feb 2017 · 2Comments · Source: elastic/elasticsearch

Currently there is no simple way to enable and disable slow logging for all indices.

If using the following cluster level settings settings in elasticsearch.yml, nodes must be restarted:

index.search.slowlog.threshold.query.debug: 30s
index.search.slowlog.threshold.fetch.debug: 15s
index.search.slowlog.level: debug

If setting dynamically at the index level, then templates and code must also be adjusted to have the new settings, which doesn't usually make sense:

PUT /*/_settings
{
    "index.search.slowlog.level" : "debug"
    "index.search.slowlog.threshold.query.debug" : "30s",
    "index.search.slowlog.threshold.fetch.debug" : "15s"
}

Ideally, it would be great if we could do:

PUT /_cluster/settings
{
   "transient": {
     "index.search.slowlog.level" : "debug",
     "index.search.slowlog.threshold.query.debug" : "1ms",
     "index.search.slowlog.threshold.fetch.debug" : "1ms"
   }
}

Source

PhaedrusTheGreek

Most helpful comment

I don't fully understand what you're asking. These settings are per index so if you want to update the settings for all indices you can just do:

PUT _settings { "index.search.slowlog.level" : "debug" "index.search.slowlog.threshold.query.debug" : "30s", "index.search.slowlog.threshold.fetch.debug" : "15s" }

If using the following cluster level settings settings in elasticsearch.yml, nodes must be restarted:

These settings are at the index level and since 5.x you cannot set index level settings in elasticsearch.yml.
So the best way to define values for all indices is to create a default template that contains these settings. Then when you want to update the values, you can update the settings for all indices and change your default template ?

jimczi on 1 Feb 2017

👍3

All 2 comments

I don't fully understand what you're asking. These settings are per index so if you want to update the settings for all indices you can just do:

PUT _settings { "index.search.slowlog.level" : "debug" "index.search.slowlog.threshold.query.debug" : "30s", "index.search.slowlog.threshold.fetch.debug" : "15s" }