# Enabling Slow Logging **URL:** \ **Category:** Elasticsearch\ **Created:** [July 10, 2017, 9:51pm UTC](https://discuss.elastic.co/t/enabling-slow-logging/92538 "2017-07-10T21:51:47Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [July 10, 2017, 9:51pm UTC](https://discuss.elastic.co/t/enabling-slow-logging/92538/1 "2017-07-10T21:51:47Z")
ES, LS, Kibana Version 5.4.0 I'm attempting to enable slow logging, as some queries are taking \>10 minutes to return the last 24 hours of data. In order to remedy this, I'm attempting to enable slow logging, but unable to get the logs to populate with data. I've followed the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules-slowlog.html) but am still not getting slow logging data. What I've done: Placed logging parameters on each index, the nginx-\* index for example: ```auto PUT /nginx-*/_settings { "index.search.slowlog.threshold.query.warn": "1s", "index.search.slowlog.threshold.query.info": "1s", "index.search.slowlog.threshold.query.debug": "1s", "index.search.slowlog.threshold.query.trace": "1ms", "index.search.slowlog.threshold.fetch.warn": "1s", "index.search.slowlog.threshold.fetch.info": "10ms", "index.search.slowlog.threshold.fetch.debug": "10ms", "index.search.slowlog.threshold.fetch.trace": "20ms" } ``` This adds what appear to be proper config for slow logging, as can be seen from querying today's index: ``` GET /_cluster/settings ``` ```auto { "persistent": {}, "transient": { "cluster": { "routing": { "allocation": { "cluster_concurrent_rebalance": "4", "node_concurrent_recoveries": "4", "disk": { "watermark": { "low": "95%", "high": "95%" } } } }, "info": { "update": { "interval": "1m" } } }, "logger": { "index": { "indexing": { "slowlog": "WARN" }, "search": { "slowlog": "DEBUG" } } } } } ``` And the index settings: ``` GET /nginx-2017.07.10/_settings ``` ```auto { "nginx-2017.07.10": { "settings": { "index": { "routing": { "allocation": { "require": { "box_type": "hot" } } }, "search": { "slowlog": { "threshold": { "fetch": { "warn": "1s", "trace": "20ms", "debug": "10ms", "info": "10ms" }, "query": { "warn": "1s", "trace": "1ms", "debug": "1s", "info": "1s" } } } }, "indexing": { "slowlog": { "threshold": { "index": { "trace": "0s", "info": "5s" } } } }, "number_of_shards": "3", "provided_name": "nginx-2017.07.10", "creation_date": "1499644778210", "number_of_replicas": "1", "uuid": "IR3V-tEZQfODxPGKFjZ4KQ", "version": { "created": "5040099" } } } } } ``` I even also restarted ES. What config am I missing? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [July 11, 2017, 9:27am UTC](https://discuss.elastic.co/t/enabling-slow-logging/92538/2 "2017-07-11T09:27:38Z")
there is no need to change the log levels in the cluster update settings... the loglevel are just misused as thresholds for slow logs. Does your dedicated slow logfile simply remain empty? ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [July 11, 2017, 2:03pm UTC](https://discuss.elastic.co/t/enabling-slow-logging/92538/3 "2017-07-11T14:03:56Z")
That's correct, all slow logs are completely empty. ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [July 17, 2017, 11:13pm UTC](https://discuss.elastic.co/t/enabling-slow-logging/92538/4 "2017-07-17T23:13:36Z")
Anyone have any ideas on something I may be missing? I have queries that are taking \>5 minutes. ![](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d360627f4202be17c2bfcbec64dd33708e010b88.png) I have verified slow searches should be getting indexed: ``` GET /nginx-2017.07.10/_settings ``` ```auto { "nginx-2017.07.17": { "settings": { "index": { "routing": { "allocation": { "require": { "box_type": "hot" } } }, "search": { "slowlog": { "threshold": { "fetch": { "warn": "1ms", "trace": "20ms", "debug": "10ms", "info": "10ms" }, "query": { "warn": "1ms", "trace": "1ms", "debug": "1ms", "info": "1ms" } } } }, "number_of_shards": "3", "provided_name": "nginx-2017.07.17", "creation_date": "1500249568478", "number_of_replicas": "1", "uuid": "ldnxrEqVQmKnSTp0bGHsSw", "version": { "created": "5040099" } } } } } ``` Are there any other settings I need to update in order to enable slow logging? ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [July 21, 2017, 2:48pm UTC](https://discuss.elastic.co/t/enabling-slow-logging/92538/5 "2017-07-21T14:48:34Z")
It appears as though slow search logs are working. I was looking for them on the client node which also runs Kibana, however it appears that the slow logs are populated on a per-node basis, logged locally on whichever node performs a slow search. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 18, 2017, 2:48pm UTC](https://discuss.elastic.co/t/enabling-slow-logging/92538/6 "2017-08-18T14:48:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.