Info on slowlog

Elastic Stack Elasticsearch
1

Hello,
we are on ES6.8 with a big cluster (many terabytes indexed per day), and sometimes the search thread pool fills up (currently the len is set to 1000).

We would like to know which queries are filling our search queue.
I'm aware of "slowlog", but I would like to know:

  1. how computationally intensive can slowlog be? How much CPU will it eat, in percentage?
  2. are there alternatives to slowlog? commands or API I can use to find slow queries

Thanks

2

The slowlog mechanism is logging queries that exceed a manually configured threshold, it does not introduce some new heavy query mechanism, if you are afraid of that.

And it is the one key to find slow queries, there are no other. The other workaround I could imagine is to log the full query time from start to query being returned in your application, that will also include network traffic (which is a good thing to have a full overview).

3

Thanks for your answer.
We would also like to know who is the user that is running a certain slow query.
We've found this parameter in the documentation (of audit):

xpack.security.audit.index.events.emit_request_body: true

but I would like to know if it's possible to enable query tracing only for slow queries (the above parameter seems to do it for every request).

Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.