I find slowlog entries in the default log and the slowlog file. Not sure why - I can't figure why they're in both places.
2.4
Here's the slowlog config:
index_indexing_slow_log_file:
type: dailyRollingFile
file: ${path.logs}/${cluster.name}_index_indexing_slowlog.log
datePattern: "'.'yyyy-MM-dd"
layout:
type: pattern
conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"