Search slowlog in JSON format is truncating the query

Elastic Stack Elasticsearch
1

I am on Elasticsearch 7.10.0 and recently I have changed the slowlogs format from plaintext to json anticipating that large query truncation issue will be resolved automatically in the json format. But I am still seeing this issue in the json format as well for the search slow logs.

Sharing a line from the json slowlog here:

{
    "type": "elasticsearch.search_slowlog",
    "timestamp": "2023-08-01T02:22:21,242Z",
    "level": "WARN",
    "component": "i.s.s.query",
    "cluster.name": "prod-es6-story",
    "node.name": "data-0-x.x.x.x",
    "message": "[complete-tagged-2023-07-v3][139] took[5.5s], took_millis[5583], total_hits[6 hits], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[300], source[{\"size\":0,\"query\":{\"constant_score\":{\"filter\":{\"bool\":{\"filter\":[{\"terms\":{\"tags_profile\":[\"lGk\"],\"boost\":1.0}},{\"range\":{\"created_at\":{\"from\":null,\"to\":null,\"include_lower\":true,\"include_upper\":true,\"boost\":1.0}}}],\"must_not\":[{\"bool\":{\"filter\":[{\"bool\":{\"must_not\":[{\"terms\":{\"tags_account_exclusion\":[\"58175874c2df937f11e23a13\",\"dO\"],\"boost\":1.0}}],\"should\":[{\"term\":{\"account_scope\":{\"value\":\"58175874c2df937f11e23a13\",\"boost\":1.0}}},{\"bool\":{\"must_not\":[{\"exists\":{\"field\":\"account_scope\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"filter\":[{\"terms\":{\"source_type\":[\"twitter\",\"news\",\"blogs\",\"facebook\",\"reddit\",\"videos\",\"lexis_nexis\",\"broadcast\",\"instagram\",\"forum\",\"qa\",\"review\"],\"boost\":1.0}},{\"bool\":{\"should\":[{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"match_phrase\":{\"text\":{\"query\":\"#CVSHealth\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSHealth\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvshealth\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvspharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"caremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvscaremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#cvscaremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"minuteclinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvsminuteclinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Health\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Pharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSPharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSPharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Caremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSCaremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSCaremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"Caremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#Caremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Minute Clinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSMinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSMinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS MinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"MinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#MinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Payor Solutions\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSPayorSolutions\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSPayorSolutions\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Speciality\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSSpeciality\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSSpeciality\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"SilverScript\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#SilverScript\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"MyChart\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#MyChart\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Caremark Specialty RX\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSCaremarkSpecialtyRX\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSCaremarkSpecialtyRX\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#cvsdelivery\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVS/Pharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvs\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#cvs\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#cvshealth\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"filter\":[{\"term\":{\"source_type\":{\"value\":\"twitter\",\"boost\":1.0}}},{\"terms\":{\"author_username\":[\"@cvsinaction\",\"@cvshealth\",\"@cvspharmacy\",\"@minuteclinic\",\"@cvshealthpbm\",\"@silverscriptpdp\"],\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"filter\":[{\"term\":{\"source_type\":{\"value\":\"twitter\",\"boost\":1.0}}},{\"terms\":{\"author_mentions\":[\"cvshealth\",\"cvsinaction\",\"cvspharmacy\",\"minuteclinic\",\"cvshealthpbm\",\"silverscriptpdp\"],\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"match_phrase\":{\"text.raw\":{\"query\":\"CVS\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text.raw\":{\"query\":\"#CVS\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text.raw\":{\"query\":\"@CVS\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"terms\":{\"page_id\":[\"658739734196897\",\"92979593115\",\"94231766381\"],\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.htlaehsvc.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.htlaehsvc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.svc.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.svc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.kramerac.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.kramerac\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.htlaehsvc.snoitulosroyap.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.htlaehsvc.snoitulosroyap\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.ytlaicepssvc.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.ytlaicepssvc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.tpircsrevlis.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.tpircsrevlis\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.tnadrocca.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.tnadrocca\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.tnadrocca.trahcym.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.tnadrocca.trahcym\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.xrytlaicepskrameracsvc.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.xrytlaicepskrameracsvc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.htlaehsvc.*\",\"boost\":1.0}}},{\"term\":{\"story_domain_reversed\":{\"value\":\"moc.htlaehsvc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.svc.*\",\"boost\":1.0}}},{\"term\":{\"story_domain_reversed\":{\"value\":\"moc.svc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.kramerac.*\",\"boost\":1.0}}},{\"term\":{\"story_domain_reversed\":{\"value\":\"moc.kramerac\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.htlaehsvc.snoitulosroyap.*\",\"boost\":1.0}}},{\"term\":{\"story_domain_reversed\":{\"value\":\"moc.htlaehsvc.snoitulosroyap\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.ytlaic",
    "cluster.uuid": "euyJJHiETH-tyAIYZ3VX0g",
    "node.id": "EosB5XtZTUuS92he1mPYEw"
}
1 Like
2

Welcome!

What is the issue?

Also it's important to upgrade if you want to keep your cluster safe. 7.17.12 is the latest version of the 7 branch.

I did not check but may be the slowlog format have been enhanced in later versions.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.