Configure slowlog

Elastic Stack Elasticsearch
1

Hi,
my purpose is to configure this settings on my ES:

    index.search.slowlog.threshold.query.warn: 10s
    index.search.slowlog.threshold.query.info: 5s
    index.search.slowlog.threshold.query.debug: 2s
    index.search.slowlog.threshold.query.trace: 500ms
  
    index.search.slowlog.threshold.fetch.warn: 1s
    index.search.slowlog.threshold.fetch.info: 800ms
    index.search.slowlog.threshold.fetch.debug: 500ms    
    index.search.slowlog.threshold.fetch.trace: 200ms
 
    index.indexing.slowlog.threshold.index.warn: 10s
    index.indexing.slowlog.threshold.index.info: 5s
    index.indexing.slowlog.threshold.index.debug: 2s
    index.indexing.slowlog.threshold.index.trace: 500ms

In my system i have 1 tribe node, 2 master node, 4 data node.

The questions are:
1 - This commands are rights????
2 - I need that all slowlog are actives in all my node.....for do this i need to modify all .yml files or i can set them in only one ?
3 - I need to modify my logging.yml for save them?
4 - For now i have insert this command in my elasticsearch.yml file, i my log i have a file for the slowlog but i have only a debug type, i try to set less time for saving but nothing is changed...someone can help me????

2

This is not good. Read Important Configuration Changes | Elasticsearch: The Definitive Guide [2.x] | Elastic

  1. That looks ok.
  2. You can also update this using _cluster/settings which negates having to update all nodes, plus it's dynamic.
  3. No.
  4. See 2.
3

thanks for response.

I used this command _cluster/settings on transient/persistent but nothing is changed.

I know about master node but for now i'm testing all log of elasticsearch also when one or more node are down.

Is there a reason why it saves only debug type ? or a settings that is necessary for active them all?