Hello,
I'm trying to get the slowlog to work in order to obtain more information about the bulk API requests from Logstash to Elasticsearch.
I added this to my logstash.yml file :
slowlog.threshold.warn: 2s
slowlog.threshold.info: 1s
slowlog.threshold.debug: 500ms
slowlog.threshold.trace: 1nanos
This seems ok as I found this in my logstash-plain.log:
[2018-02-12T16:06:05,849][DEBUG][logstash.runner ] *slowlog.threshold.warn: 2000000000 (default: -1)
[2018-02-12T16:06:05,849][DEBUG][logstash.runner ] *slowlog.threshold.info: 1000000000 (default: -1)
[2018-02-12T16:06:05,849][DEBUG][logstash.runner ] *slowlog.threshold.debug: 500000000 (default: -1)
[2018-02-12T16:06:05,849][DEBUG][logstash.runner ] *slowlog.threshold.trace: 1 (default: -1)
Now, I would expect that every single event (or at least bulk API request) to Elasticsearch gets logged when I set the slowlog.logstash.outputs.elasticsearch to 'TRACE' but instead it seems like nothing happens. I tried putting slowlog.logstash.filters.xml to 'TRACE' and that worked as expected: every single event passing through the filter gets logged.
I tried removing the conditional on the Elasticsearch output in my pipeline config but that didn't help.
Am I doing something wrong or did I miss something somehow?
Thanks a lot!
KR,
Jonas