Capturing elastic search requests

Elastic Stack Elasticsearch
1

Hi,
im using elastic search on a local node configuration,
also im using a client (elastic4s) in order to index the data ,
so i want to see that the client is actually sending to the server .
i configure Wireshark to capture like that (tcp.port >= 9200 and tcp.port
<= 9300)
but i cant figure out which data was sent to the ES Server
can you recommend a better Wireshark filter OR another tool in order to
catch ES requests .

thanks

miki

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

Hello Miki ,

I believe the right approach would be to enable slow log -

Thanks
Vineeth

On Sat, Apr 19, 2014 at 4:21 PM, miki haiat miko5054@gmail.com wrote:

Hi,
im using Elasticsearch on a local node configuration,
also im using a client (elastic4s) in order to index the data ,
so i want to see that the client is actually sending to the server .
i configure Wireshark to capture like that (tcp.port >= 9200 and tcp.port
<= 9300)
but i cant figure out which data was sent to the ES Server
can you recommend a better Wireshark filter OR another tool in order to
catch ES requests .

thanks

miki

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAGdPd5kPrPoCfVmh9KmVDqfQ36MtMrst60nV18B__qB5O2xzZQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

that an excellent approach ,
i edit the the configuration file to this and restart the server

Shard level query and fetch threshold logging.

index.search.slowlog.threshold.query.warn: 10s
index.search.slowlog.threshold.query.info: 5s
index.search.slowlog.threshold.query.debug: 2s
index.search.slowlog.threshold.query.trace: 500ms

index.search.slowlog.threshold.fetch.warn: 1s
index.search.slowlog.threshold.fetch.info: 800ms
index.search.slowlog.threshold.fetch.debug: 500ms
index.search.slowlog.threshold.fetch.trace: 200ms

index.indexing.slowlog.threshold.index.warn: 10s
index.indexing.slowlog.threshold.index.info: 5s
index.indexing.slowlog.threshold.index.debug: 2s
index.indexing.slowlog.threshold.index.trace: 500ms

i was expecting the data to written in _index_indexing_slowlog.log

but nothing happened , what im missing ?

thanks miki

On Saturday, April 19, 2014 2:31:44 PM UTC+3, vineeth mohan wrote:

Hello Miki ,

I believe the right approach would be to enable slow log -
Elasticsearch Platform — Find real-time answers at scale | Elastic

Thanks
Vineeth

On Sat, Apr 19, 2014 at 4:21 PM, miki haiat <miko...@gmail.com<javascript:>

wrote:

Hi,
im using Elasticsearch on a local node configuration,
also im using a client (elastic4s) in order to index the data ,
so i want to see that the client is actually sending to the server .
i configure Wireshark to capture like that (tcp.port >= 9200 and
tcp.port <= 9300)
but i cant figure out which data was sent to the ES Server
can you recommend a better Wireshark filter OR another tool in order to
catch ES requests .

thanks

miki

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearc...@googlegroups.com <javascript:>.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

4

Hello Miki ,

Can you try

index.search.slowlog.threshold.query.info: 0s

alone and see

Thanks
Vineeth

On Sat, Apr 19, 2014 at 8:33 PM, miki haiat miko5054@gmail.com wrote:

that an excellent approach ,
i edit the the configuration file to this and restart the server

Shard level query and fetch threshold logging.

index.search.slowlog.threshold.query.warn: 10s
index.search.slowlog.threshold.query.info: 5s
index.search.slowlog.threshold.query.debug: 2s
index.search.slowlog.threshold.query.trace: 500ms

index.search.slowlog.threshold.fetch.warn: 1s
index.search.slowlog.threshold.fetch.info: 800ms
index.search.slowlog.threshold.fetch.debug: 500ms
index.search.slowlog.threshold.fetch.trace: 200ms

index.indexing.slowlog.threshold.index.warn: 10s
index.indexing.slowlog.threshold.index.info: 5s
index.indexing.slowlog.threshold.index.debug: 2s
index.indexing.slowlog.threshold.index.trace: 500ms

i was expecting the data to written in _index_indexing_slowlog.log

but nothing happened , what im missing ?

thanks miki

On Saturday, April 19, 2014 2:31:44 PM UTC+3, vineeth mohan wrote:

Hello Miki ,

I believe the right approach would be to enable slow log -
Elasticsearch Platform — Find real-time answers at scale | Elastic
reference/current/index-modules-slowlog.html#search-slow-log

Thanks
Vineeth

On Sat, Apr 19, 2014 at 4:21 PM, miki haiat miko...@gmail.com wrote:

Hi,
im using Elasticsearch on a local node configuration,
also im using a client (elastic4s) in order to index the data ,
so i want to see that the client is actually sending to the server .
i configure Wireshark to capture like that (tcp.port >= 9200 and
tcp.port <= 9300)
but i cant figure out which data was sent to the ES Server
can you recommend a better Wireshark filter OR another tool in order to
catch ES requests .

thanks

miki

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%
40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1_f9AA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

5

i change it to that but steel same result nothing is written to the log
file

#index.search.slowlog.threshold.query.warn: 10s
#index.search.slowlog.threshold.query.info: 5s
#index.search.slowlog.threshold.query.debug: 2s
#index.search.slowlog.threshold.query.trace: 500ms

#index.search.slowlog.threshold.fetch.warn: 1s
#index.search.slowlog.threshold.fetch.info: 800ms
#index.search.slowlog.threshold.fetch.debug: 500ms
#index.search.slowlog.threshold.fetch.trace: 200ms

#index.indexing.slowlog.threshold.index.warn: 10s
#index.indexing.slowlog.threshold.index.info: 5s
#index.indexing.slowlog.threshold.index.debug: 2s
#index.indexing.slowlog.threshold.index.trace: 500ms

index.search.slowlog.threshold.query.info
http://index.search.slowlog.threshold.query.info: 0s

On Sat, Apr 19, 2014 at 8:26 PM, vineeth mohan vm.vineethmohan@gmail.comwrote:

Hello Miki ,

Can you try

index.search.slowlog.threshold.query.info: 0s

alone and see

Thanks
Vineeth

On Sat, Apr 19, 2014 at 8:33 PM, miki haiat miko5054@gmail.com wrote:

that an excellent approach ,
i edit the the configuration file to this and restart the server

Shard level query and fetch threshold logging.

index.search.slowlog.threshold.query.warn: 10s
index.search.slowlog.threshold.query.info: 5s
index.search.slowlog.threshold.query.debug: 2s
index.search.slowlog.threshold.query.trace: 500ms

index.search.slowlog.threshold.fetch.warn: 1s
index.search.slowlog.threshold.fetch.info: 800ms
index.search.slowlog.threshold.fetch.debug: 500ms
index.search.slowlog.threshold.fetch.trace: 200ms

index.indexing.slowlog.threshold.index.warn: 10s
index.indexing.slowlog.threshold.index.info: 5s
index.indexing.slowlog.threshold.index.debug: 2s
index.indexing.slowlog.threshold.index.trace: 500ms

i was expecting the data to written in _index_indexing_slowlog.log

but nothing happened , what im missing ?

thanks miki

On Saturday, April 19, 2014 2:31:44 PM UTC+3, vineeth mohan wrote:

Hello Miki ,

I believe the right approach would be to enable slow log -
Elasticsearch Platform — Find real-time answers at scale | Elastic
reference/current/index-modules-slowlog.html#search-slow-log

Thanks
Vineeth

On Sat, Apr 19, 2014 at 4:21 PM, miki haiat miko...@gmail.com wrote:

Hi,
im using Elasticsearch on a local node configuration,
also im using a client (elastic4s) in order to index the data ,
so i want to see that the client is actually sending to the server .
i configure Wireshark to capture like that (tcp.port >= 9200 and
tcp.port <= 9300)
but i cant figure out which data was sent to the ES Server
can you recommend a better Wireshark filter OR another tool in order
to catch ES requests .

thanks

miki

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/
msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%
40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/PR9sw16oL3U/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1_f9AA%40mail.gmail.comhttps://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1_f9AA%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAO2g_KwD60FTK-9CZJ6MJaPyonD7H9OSWqie%3DxBoszwhuOOitA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.