# Capturing elastic search requests **URL:** \ **Category:** Elasticsearch\ **Created:** [April 19, 2014, 10:51am UTC](https://discuss.elastic.co/t/capturing-elastic-search-requests/17096 "2014-04-19T10:51:57Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![miki\_haiat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miki_haiat/32/83361_2.png) [@miki\_haiat](https://discuss.elastic.co/u/miki_haiat)\ **Post date:** [April 19, 2014, 10:51am UTC](https://discuss.elastic.co/t/capturing-elastic-search-requests/17096/1 "2014-04-19T10:51:57Z")
Hi, im using elastic search on a local node configuration, also im using a client (elastic4s) in order to index the data , so i want to see that the client is actually sending to the server . i configure Wireshark to capture like that (tcp.port \>= 9200 and tcp.port \<= 9300) but i cant figure out which data was sent to the ES Server can you recommend a better Wireshark filter OR another tool in order to catch ES requests . thanks miki -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![vineeth\_mohan\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vineeth_mohan_2/32/747_2.png) [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\ **Post date:** [April 19, 2014, 11:31am UTC](https://discuss.elastic.co/t/capturing-elastic-search-requests/17096/2 "2014-04-19T11:31:44Z")
Hello Miki , I believe the right approach would be to enable slow log - > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. Thanks Vineeth On Sat, Apr 19, 2014 at 4:21 PM, miki haiat [miko5054@gmail.com](mailto:miko5054@gmail.com) wrote: > Hi, > im using Elasticsearch on a local node configuration, > also im using a client (elastic4s) in order to index the data , > so i want to see that the client is actually sending to the server . > i configure Wireshark to capture like that (tcp.port \>= 9200 and tcp.port > \<= 9300) > but i cant figure out which data was sent to the ES Server > can you recommend a better Wireshark filter OR another tool in order to > catch ES requests . > > thanks > > miki > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGdPd5kPrPoCfVmh9KmVDqfQ36MtMrst60nV18B\_\_qB5O2xzZQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5kPrPoCfVmh9KmVDqfQ36MtMrst60nV18B__qB5O2xzZQ%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![miki\_haiat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miki_haiat/32/83361_2.png) [@miki\_haiat](https://discuss.elastic.co/u/miki_haiat)\ **Post date:** [April 19, 2014, 3:03pm UTC](https://discuss.elastic.co/t/capturing-elastic-search-requests/17096/3 "2014-04-19T15:03:42Z")
that an excellent approach , i edit the the configuration file to this and restart the server # Shard level query and fetch threshold logging. index.search.slowlog.threshold.query.warn: 10s index.search.slowlog.threshold.query.info: 5s index.search.slowlog.threshold.query.debug: 2s index.search.slowlog.threshold.query.trace: 500ms index.search.slowlog.threshold.fetch.warn: 1s index.search.slowlog.threshold.fetch.info: 800ms index.search.slowlog.threshold.fetch.debug: 500ms index.search.slowlog.threshold.fetch.trace: 200ms index.indexing.slowlog.threshold.index.warn: 10s index.indexing.slowlog.threshold.index.info: 5s index.indexing.slowlog.threshold.index.debug: 2s index.indexing.slowlog.threshold.index.trace: 500ms i was expecting the data to written in \_index\_indexing\_slowlog.log but nothing happened , what im missing ? thanks miki On Saturday, April 19, 2014 2:31:44 PM UTC+3, vineeth mohan wrote: > Hello Miki , > > I believe the right approach would be to enable slow log - > [Elastic — The Search AI Company | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/index-modules-slowlog.html#search-slow-log) > > Thanks > Vineeth > > On Sat, Apr 19, 2014 at 4:21 PM, miki haiat \<[miko...@gmail.com](mailto:miko...@gmail.com)\ > > > wrote: > > > Hi, > > im using Elasticsearch on a local node configuration, > > also im using a client (elastic4s) in order to index the data , > > so i want to see that the client is actually sending to the server . > > i configure Wireshark to capture like that (tcp.port \>= 9200 and > > tcp.port \<= 9300) > > but i cant figure out which data was sent to the ES Server > > can you recommend a better Wireshark filter OR another tool in order to > > catch ES requests . > > > > thanks > > > > miki > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![vineeth\_mohan\_2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vineeth_mohan_2/32/747_2.png) [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\ **Post date:** [April 19, 2014, 5:26pm UTC](https://discuss.elastic.co/t/capturing-elastic-search-requests/17096/4 "2014-04-19T17:26:01Z")
Hello Miki , Can you try index.search.slowlog.threshold.query.info: 0s alone and see Thanks Vineeth On Sat, Apr 19, 2014 at 8:33 PM, miki haiat [miko5054@gmail.com](mailto:miko5054@gmail.com) wrote: > that an excellent approach , > i edit the the configuration file to this and restart the server > > # Shard level query and fetch threshold logging. > > index.search.slowlog.threshold.query.warn: 10s > index.search.slowlog.threshold.query.info: 5s > index.search.slowlog.threshold.query.debug: 2s > index.search.slowlog.threshold.query.trace: 500ms > > index.search.slowlog.threshold.fetch.warn: 1s > index.search.slowlog.threshold.fetch.info: 800ms > index.search.slowlog.threshold.fetch.debug: 500ms > index.search.slowlog.threshold.fetch.trace: 200ms > > index.indexing.slowlog.threshold.index.warn: 10s > index.indexing.slowlog.threshold.index.info: 5s > index.indexing.slowlog.threshold.index.debug: 2s > index.indexing.slowlog.threshold.index.trace: 500ms > > i was expecting the data to written in \_index\_indexing\_slowlog.log > > but nothing happened , what im missing ? > > thanks miki > > On Saturday, April 19, 2014 2:31:44 PM UTC+3, vineeth mohan wrote: > > > Hello Miki , > > > > I believe the right approach would be to enable slow log - > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/) > > reference/current/index-modules-slowlog.html#search-slow-log > > > > Thanks > > Vineeth > > > > On Sat, Apr 19, 2014 at 4:21 PM, miki haiat [miko...@gmail.com](mailto:miko...@gmail.com) wrote: > > > > > Hi, > > > im using Elasticsearch on a local node configuration, > > > also im using a client (elastic4s) in order to index the data , > > > so i want to see that the client is actually sending to the server . > > > i configure Wireshark to capture like that (tcp.port \>= 9200 and > > > tcp.port \<= 9300) > > > but i cant figure out which data was sent to the ES Server > > > can you recommend a better Wireshark filter OR another tool in order to > > > catch ES requests . > > > > > > thanks > > > > > > miki > > > > > > -- > > > You received this message because you are subscribed to the Google > > > Groups "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/) > > > msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755% > > > [40googlegroups.com](http://40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm_medium=email&utm_source=footer) > > > . > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1\_f9AA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1_f9AA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![miki\_haiat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miki_haiat/32/83361_2.png) [@miki\_haiat](https://discuss.elastic.co/u/miki_haiat)\ **Post date:** [April 19, 2014, 5:43pm UTC](https://discuss.elastic.co/t/capturing-elastic-search-requests/17096/5 "2014-04-19T17:43:37Z")
i change it to that but steel same result nothing is written to the log file #index.search.slowlog.threshold.query.warn: 10s #index.search.slowlog.threshold.query.info: 5s #index.search.slowlog.threshold.query.debug: 2s #index.search.slowlog.threshold.query.trace: 500ms #index.search.slowlog.threshold.fetch.warn: 1s #index.search.slowlog.threshold.fetch.info: 800ms #index.search.slowlog.threshold.fetch.debug: 500ms #index.search.slowlog.threshold.fetch.trace: 200ms #index.indexing.slowlog.threshold.index.warn: 10s #index.indexing.slowlog.threshold.index.info: 5s #index.indexing.slowlog.threshold.index.debug: 2s #index.indexing.slowlog.threshold.index.trace: 500ms _index.search.slowlog.threshold.query.info [http://index.search.slowlog.threshold.query.info](http://index.search.slowlog.threshold.query.info): 0s_ On Sat, Apr 19, 2014 at 8:26 PM, vineeth mohan [vm.vineethmohan@gmail.com](mailto:vm.vineethmohan@gmail.com)wrote: > Hello Miki , > > Can you try > > index.search.slowlog.threshold.query.info: 0s > > alone and see > > Thanks > Vineeth > > On Sat, Apr 19, 2014 at 8:33 PM, miki haiat [miko5054@gmail.com](mailto:miko5054@gmail.com) wrote: > > > that an excellent approach , > > i edit the the configuration file to this and restart the server > > > > # Shard level query and fetch threshold logging. > > > > index.search.slowlog.threshold.query.warn: 10s > > index.search.slowlog.threshold.query.info: 5s > > index.search.slowlog.threshold.query.debug: 2s > > index.search.slowlog.threshold.query.trace: 500ms > > > > index.search.slowlog.threshold.fetch.warn: 1s > > index.search.slowlog.threshold.fetch.info: 800ms > > index.search.slowlog.threshold.fetch.debug: 500ms > > index.search.slowlog.threshold.fetch.trace: 200ms > > > > index.indexing.slowlog.threshold.index.warn: 10s > > index.indexing.slowlog.threshold.index.info: 5s > > index.indexing.slowlog.threshold.index.debug: 2s > > index.indexing.slowlog.threshold.index.trace: 500ms > > > > i was expecting the data to written in \_index\_indexing\_slowlog.log > > > > but nothing happened , what im missing ? > > > > thanks miki > > > > On Saturday, April 19, 2014 2:31:44 PM UTC+3, vineeth mohan wrote: > > > > > Hello Miki , > > > > > > I believe the right approach would be to enable slow log - > > > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/) > > > reference/current/index-modules-slowlog.html#search-slow-log > > > > > > Thanks > > > Vineeth > > > > > > On Sat, Apr 19, 2014 at 4:21 PM, miki haiat [miko...@gmail.com](mailto:miko...@gmail.com) wrote: > > > > > > > Hi, > > > > im using Elasticsearch on a local node configuration, > > > > also im using a client (elastic4s) in order to index the data , > > > > so i want to see that the client is actually sending to the server . > > > > i configure Wireshark to capture like that (tcp.port \>= 9200 and > > > > tcp.port \<= 9300) > > > > but i cant figure out which data was sent to the ES Server > > > > can you recommend a better Wireshark filter OR another tool in order > > > > to catch ES requests . > > > > > > > > thanks > > > > > > > > miki > > > > > > > > -- > > > > You received this message because you are subscribed to the Google > > > > Groups "elasticsearch" group. > > > > To unsubscribe from this group and stop receiving emails from it, send > > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com). > > > > > > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/) > > > > msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755% > > > > [40googlegroups.com](http://40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/a2a5717a-b6c1-4826-a36e-38ff51d7f755%40googlegroups.com?utm_medium=email&utm_source=footer) > > > > . > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > > > -- > > > You received this message because you are subscribed to the Google Groups > > > "elasticsearch" group. > > > To unsubscribe from this group and stop receiving emails from it, send an > > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > > To view this discussion on the web visit > > > [https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/e5aa6d22-781e-44d4-afef-473b9a6c2c81%40googlegroups.com?utm_medium=email&utm_source=footer) > > > . > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/PR9sw16oL3U/unsubscribe](https://groups.google.com/d/topic/elasticsearch/PR9sw16oL3U/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1\_f9AA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1_f9AA%40mail.gmail.com)[https://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1\_f9AA%40mail.gmail.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/CAGdPd5%3DXieB83ytrLOjS8eU3RG5QyZzKGGi3Ja5VyNA%3D1_f9AA%40mail.gmail.com?utm_medium=email&utm_source=footer) > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAO2g\_KwD60FTK-9CZJ6MJaPyonD7H9OSWqie%3DxBoszwhuOOitA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAO2g_KwD60FTK-9CZJ6MJaPyonD7H9OSWqie%3DxBoszwhuOOitA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:34am UTC](https://discuss.elastic.co/t/capturing-elastic-search-requests/17096/6 "2017-07-06T01:34:48Z")