Set the global log level to ERROR

[1222kkk (new to Es)]

hi all,
I just wonder how to set the global log level of elastisearch. I found the configure file of log via ${es_home}/conf/log4j2.properties.

As the showing below:

status = error

# log action execution errors for easier debugging
logger.action.name = org.elasticsearch.action
logger.action.level = debug

appender.console.type = Console
appender.console.name = console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n

...

what does the status means ?

Can I can just set status = error to ensure the all global log level to error?

or I have to set all relative settings showed in configure file like :

logger.<unique_identifier>.name = <name of logging hierarchy>
logger.<unique_identifier>.level = error

[jasontedor]

A few things here:

1. Why would you want to set the top-level log level to error? This means that you will have any informative log messages like if an index is created or deleted, etc. Informational messages are valuable if you need to reconstruct why your cluster is in a certain state. I strongly advise against making the change that you are seeking.
2. The status = error is setting the log level for the status logger, a special logger internal to Log4j 2, you do not need to worry about this setting and you should not change it.

[1222kkk (new to Es)]

HI,

I'm facing a situation that when I leave the log level not changed, sometimes log may increase to 10+ GB or more every day once there's something wrong with cluster.

The left space of disk may decrease in a very short time and may result in a series of problems.

After checking the log message, I found the type of them is always 'WARN'. It's due to unproper query, but I'd like to limit the disk space of log.

So I'd like to set log level to ''ERROR" to decrease the risk of full disk.

[jasontedor]

This is not the right solution to this problem. You should stop the offending query. Changing the log level to error only will leave you in a worse state because you will not have logs to diagnose other problems in the cluster.