"Bad Request" loggued with debug level?

Elastic Stack Elasticsearch
#1

I have to set log level DEBUG to see Bad Request error:

{"type": "server", "timestamp": "2021-02-04T10:19:16,959Z", "level": "DEBUG", "component": "r.suppressed", "cluster.name": "conso", "node.name": "conso-es-client-0", "message": "path: /_index_template/conso, params: {name=conso}", "cluster.uuid": "2YaiBtXgQMqyDdNJgWecFg", "node.id": "BzJq_ehNSo-5kH1ugwWrlw" ,
"stacktrace": ["org.elasticsearch.common.xcontent.XContentParseException: [1:1] [index_template] Expected START_OBJECT but was: VALUE_STRING",

is it normal?

#2

Yes, that's normal. These errors are returned to the client with the expectation that it's the client's job to deal with them, so there's little point in filling the server logs with them too.

#3

woa, I see plenty of errors now from our prod clusters :confused:

But too many logs now, is it possible to see only client errors without all debug logs?

#4

You can set specific loggers to DEBUG; the logger for the message you quote above is rest.suppressed which might be enough for you. I still recommend against using the server logs for investigating client errors, it's much better to deal with these on the client. For instance, the server logs won't identify the specific client that triggered the error, nor do they record errors returned to clients by other means (e.g. from a proxy, maybe also security failures don't appear here).