Replace DailyRollingFileAppender for index slow log

Elastic Stack Elasticsearch
1

hy all
i try to set up the slow log in elasticsearch, i read a lot of doc and i
found a email between igor motov and kimchy where they say
"
Slow queries are logged by a standard ES logger. The logging.xml file
configures this logger to use DailyRollingFileAppender to log slow query
messages to a separate file. You can replace DailyRollingFileAppender with
your own custom appender by adding your appender to the elasticsearch
classpath and specifying your appender's class name in
"
Where i creat my own appender ? and where is elasticsearch classpath ?

For the moment i do this on logging.yml
where is my mistake ??

53
appender:

54 index_search_slow_log_file:
55 type: indexSlowlog
56 file: ${path.logs}/${cluster.name}_index_search_slowlog.log
57 datePattern: "'.'yyyy-MM-dd"
58 layout:
59 type: pattern
60 conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"

and in my elasticsearch.json i added

3 "path" : {
14 "logs" : "/var/log/elasticsearch",
15 "data" : "/data/elasticsearch",
16 "conf" : "/etc/elasticsearch"
17 "indexSlowlog : "/var/log/elasticsearch",

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/0d4cd440-ba05-4413-a3a4-e8e8902716e0%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Nobody know ?

2013/12/17 olivier morel oliviermo75@gmail.com

hy all
i try to set up the slow log in elasticsearch, i read a lot of doc and i
found a email between igor motov and kimchy where they say
"
Slow queries are logged by a standard ES logger. The logging.xml file
configures this logger to use DailyRollingFileAppender to log slow query
messages to a separate file. You can replace DailyRollingFileAppender with
your own custom appender by adding your appender to the elasticsearch
classpath and specifying your appender's class name in
"
Where i creat my own appender ? and where is elasticsearch classpath ?

For the moment i do this on logging.yml
where is my mistake ??

53
appender:

54 index_search_slow_log_file:
55 type: indexSlowlog
56 file: ${path.logs}/${cluster.name}_index_search_slowlog.log
57 datePattern: "'.'yyyy-MM-dd"
58 layout:
59 type: pattern
60 conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"

and in my elasticsearch.json i added

3 "path" : {
14 "logs" : "/var/log/elasticsearch",
15 "data" : "/data/elasticsearch",
16 "conf" : "/etc/elasticsearch"
17 "indexSlowlog : "/var/log/elasticsearch",

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/_iO_l-snRas/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/0d4cd440-ba05-4413-a3a4-e8e8902716e0%40googlegroups.com
.
For more options, visit https://groups.google.com/groups/opt_out.

--
Cordialement

Olivier Morel
tel : 06.62.25.03.77

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAJnWC-8rS9Sw%2B%3DC6_zvQ%2BT-kkDa4ZprDjQdOVX6aVnZ93yKETA%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Can you give more info about log type "indexSlowLog"? Did you write an
implementation of "org.apache.log4j.IndexSlowLogAppender" - and why?

Look here

https://groups.google.com/forum/#!topic/elasticsearch/pPRXkI9P2hA

and here

how to set a standard log4j appender class, or your favorite custom class
name in "type".

Jörg

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAKdsXoHW2b5kUVQr3rST3YGgO7fWcuJYX1qHxoFEeeB_eGuD2Q%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

4

i found some discusion about the same problem but he doesn't say how to
resolv it !

2013/12/18 joergprante@gmail.com joergprante@gmail.com

Can you give more info about log type "indexSlowLog"? Did you write an
implementation of "org.apache.log4j.IndexSlowLogAppender" - and why?

Look here

Redirecting to Google Groups

and here

Elasticsearch Platform — Find real-time answers at scale | Elastic

how to set a standard log4j appender class, or your favorite custom class
name in "type".

Jörg

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/_iO_l-snRas/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAKdsXoHW2b5kUVQr3rST3YGgO7fWcuJYX1qHxoFEeeB_eGuD2Q%40mail.gmail.com
.

For more options, visit https://groups.google.com/groups/opt_out.

--
Cordialement

Olivier Morel
tel : 06.62.25.03.77

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAJnWC-8z%3Du4Rr-DP%2B3z4aD%2BOheihWzB%2BsGs5N%3DUU78DA37QT%2BQ%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

5

sorry
https://groups.google.com/forum/#!msg/elasticsearch/A3BAizeh10s/ohBnJmHMlF8J

" Can you give more info about log type "indexSlowLog"? Did you write an
implementation of "org.apache.log4j.
IndexSlowLogAppender" - and why? "

in this post they talk about ( You can replace
DailyRollingFileAppender with your own custom appender by adding your
appender to the elasticsearch classpath and specifying your appender's
class name in
)

i didn't write any implementation in
org.apache.log4j

2013/12/18 Olivier Morel oliviermo75@gmail.com

i found some discusion about the same problem but he doesn't say how to
resolv it !

2013/12/18 joergprante@gmail.com joergprante@gmail.com

Can you give more info about log type "indexSlowLog"? Did you write an

implementation of "org.apache.log4j.IndexSlowLogAppender" - and why?

Look here

Redirecting to Google Groups

and here

Elasticsearch Platform — Find real-time answers at scale | Elastic

how to set a standard log4j appender class, or your favorite custom class
name in "type".

Jörg

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/_iO_l-snRas/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAKdsXoHW2b5kUVQr3rST3YGgO7fWcuJYX1qHxoFEeeB_eGuD2Q%40mail.gmail.com
.

For more options, visit https://groups.google.com/groups/opt_out.

--
Cordialement

Olivier Morel
tel : 06.62.25.03.77

--
Cordialement

Olivier Morel
tel : 06.62.25.03.77

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAJnWC-8US4Pg_J4vKN%3DYZmajS8cyhrBNAHCwgRgHR0tcmsOnog%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

6

Maybe I do not understand your question.

You do not want type: dailyRollingFile, ok. But what log appender do you
want to install instead? There are console, file, etc.

Are you familiar with log4j? It's quite clear that you can replace the
log4j appender type with your custom type. So ,if you have no custom one
written for yourself, what are you really looking for?

Jörg

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAKdsXoEi%3DvrAFtYzgyKpDmk7t_i7dQDKvL3Eg1WViej2Tc4bsg%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

7

i get all log in /var/log/elasticsearch/${cluster_name}.log

i would want two file one with all slow query inside like that
/var/log/elasticsearch/${cluster_name}_slow_query.log
and another one with other query .

for that i try this

in logging.yml for slow query

53 appender:
54 index_search_slow_log_file:
55 type: dailyRollingFile
56 file: ${path.logs}/${cluster.name}_index_slowlog.log
57 datePattern: "'.'yyyy-MM-dd"
58 layout:
59 type: pattern
60 conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"

and for other query

45 file:
46 type: dailyRollingFile
47 file: ${path.logs}/${cluster.name}.log
48 datePattern: "'.'yyyy-MM-dd"
49 layout:
50 type: pattern
51 conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"

but that doesn't work i dont know why . i make a mistake or something else ?

2013/12/18 joergprante@gmail.com joergprante@gmail.com

Maybe I do not understand your question.

You do not want type: dailyRollingFile, ok. But what log appender do you
want to install instead? There are console, file, etc.

Are you familiar with log4j? It's quite clear that you can replace the
log4j appender type with your custom type. So ,if you have no custom one
written for yourself, what are you really looking for?

Jörg

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/_iO_l-snRas/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAKdsXoEi%3DvrAFtYzgyKpDmk7t_i7dQDKvL3Eg1WViej2Tc4bsg%40mail.gmail.com
.

For more options, visit https://groups.google.com/groups/opt_out.

--
Cordialement

Olivier Morel
tel : 06.62.25.03.77 skype:0662250377?call

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAJnWC-8n7OzzRh5LRLbathxq-tybBsVa14-hb_%2BMY0ZORuacBw%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

8

The configuration looks good, it is documented in
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/index-modules-slowlog.html

What does it mean "it doesn't work"? Maybe you don't have entries for slow
log?

Jörg

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAKdsXoHVDL1A_Qb%2BhPoQR%2BHYK5uOYST-Sykmk9jMnec-sYy9yA%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.

9

I already have read this documentation,i dont understand why i cant get my
slow log in another file.
I dont understand why elasticsearch doesn't create the file /${cluster.name
}_index_slowlog.log.

i added in elasticsearch.json this

"search": {
45 "slowlog": {
46 "threshold": {
47 "query": {
48 "warn": "1s",
49 "info": "2s",
50 "debug": "3s",
51 "trace": "500ms"
52 }
53 }
54 }
55 },

what i have mistake

2013/12/19 joergprante@gmail.com joergprante@gmail.com

The configuration looks good, it is documented in
Elasticsearch Platform — Find real-time answers at scale | Elastic

What does it mean "it doesn't work"? Maybe you don't have entries for slow
log?

Jörg

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/_iO_l-snRas/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAKdsXoHVDL1A_Qb%2BhPoQR%2BHYK5uOYST-Sykmk9jMnec-sYy9yA%40mail.gmail.com
.

For more options, visit https://groups.google.com/groups/opt_out.

--
Cordialement

Olivier Morel
tel : 06.62.25.03.77

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAJnWC--sORuJ9F6KPsM1yYooLrG8b3VBXnGk%3DfeY6DO5%2B%3DzNYw%40mail.gmail.com.
For more options, visit https://groups.google.com/groups/opt_out.