Deprication logs dump WARN message even after setting deprication log level to ERROR

Hi All
We're running ES cluster (version6.8.6) with the following settings.

  PUT /_cluster/settings
  {
    "persistent" : {
  	"logger._root": "DEBUG",
    "logger.org.elasticsearch.deprecation": "ERROR"
    }
  }

But, we're still seeing a ton of WARN deprecation log message being dumped out. These deprication logs are quickly growing to multiple GBs in size.

    [2021-03-01T21:50:20,876][WARN ][o.e.d.s.DeprecationMap   ] [XXXXXXXX.XXX.XXX.net] Accessing variable [_agg] via [params._agg] from within a scripted metric agg combine script is deprecated in favor of using [state].
    [2021-03-01T21:50:20,878][WARN ][o.e.d.s.DeprecationMap   ] [XXXXXXXX.XXX.XXX.net] Accessing variable [_aggs] via [params._aggs] from within a scripted metric agg reduce script is deprecated in favor of using [state].
    [2021-03-01T21:52:04,205][WARN ][o.e.d.s.a.MultiBucketConsumerService] [XXXXXXXX.XXX.XXX.net] This aggregation creates too many buckets (10001) and will throw an error in future versions. You should update the [search.max_buckets] cluster setting or use the [composite] aggregation to paginate all buckets in multiple requests. 

A snippet of the log4j.properties file

    status = error

    # log action execution errors for easier debugging
    logger.action.name = org.elasticsearch.action
    logger.action.level = debug

    appender.console.type = Console
    appender.console.name = console
    appender.console.layout.type = PatternLayout
    appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n

    # See the link below for details about ES log configuration
    # https://www.elastic.co/guide/en/elasticsearch/reference/current/settings.html
    # Default Elasticsearch logging file
    appender.file.type = File
    appender.file.name = file
    appender.file.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}.log
    appender.file.layout.type = PatternLayout
    appender.file.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.-10000m%n

    rootLogger.level = info
    rootLogger.appenderRef.console.ref = console
    rootLogger.appenderRef.file.ref = file

    # Elasticsearch deprecation logging
    appender.deprecation.type = File
    appender.deprecation.name = deprecation
    appender.deprecation.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_deprecation.log
    appender.deprecation.layout.type = PatternLayout
    appender.deprecation.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.-10000m%n

    logger.deprecation.name = org.elasticsearch.deprecation
    logger.deprecation.level = warn
    logger.deprecation.appenderRef.deprecation.ref = deprecation
    logger.deprecation.additivity = false

A help on this would be really appreciated. Please let me know if any other information can help!

I'd really appreciate it if I can get some ideas on this one.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.