Turn off ES deprecation Logs Dynamically

Elastic Stack Elasticsearch
1

I know there is a way to turn off deprecation logs via static config as documented here: https://www.elastic.co/guide/en/elasticsearch/reference/6.7/logging.html#deprecation-logging

However, I wasn't sure if there is a dynamic configuration that does NOT require a cluster restart (rolling or a full restart) that disables logging for ES deprecation logs. It generates about 15G of logs on every host in the cluster. Its painful.

Please let me know. Thank you.

2

Update:

It looks like I might have found the solution. I should have waited for a bit more before posting the question. I googled this question and I didn't find a good answer anywhere. So, I hope this helps others.

curl -X PUT "localhost:9200/_cluster/settings?flat_settings=true&pretty" -H 'Content-Type: application/json' -d'
{
    "transient" : {
        "logger.org.elasticsearch.deprecation": "ERROR"
    }
}'
2 Likes
4

Turning them off may cause you issues in the future if you try and upgrade without turning them back on first.

Are you seeing lots of duplicate messages? If so, can you share examples? Elasticsearch should be deduplicating these logs to keep the volume under control, so maybe there's a bug here.

5

Thanks David. That's a good point. We are only disabling this in production. Our beta has deprecation logs enabled. They are all the same logs. See an example log below.

[2020-03-02T22:21:15,295][WARN ][o.e.d.c.ParseField       ] Deprecated field [_version] used, expected [version] instead
[2020-03-02T22:21:15,295][WARN ][o.e.d.c.ParseField       ] Deprecated field [_version_type] used, expected [version_type] instead
[2020-03-02T22:21:15,296][WARN ][o.e.d.c.ParseField       ] Deprecated field [_version] used, expected [version] instead
[2020-03-02T22:21:15,296][WARN ][o.e.d.c.ParseField       ] Deprecated field [_version_type] used, expected [version_type] instead
[2020-03-02T22:22:00,181][WARN ][o.e.d.c.ParseField       ] Deprecated field [_version] used, expected [version] instead
[2020-03-02T22:22:00,182][WARN ][o.e.d.c.ParseField       ] Deprecated field [_version_type] used, expected [version_type] instead
[2020-03-02T22:22:00,182][WARN ][o.e.d.c.ParseField       ] Deprecated field [_version] used, expected [version] instead
[2020-03-02T22:22:00,182][WARN ][o.e.d.c.ParseField       ] Deprecated field [_version_type] used, expected [version_type] instead
6

Thanks, that helps. I opened https://github.com/elastic/elasticsearch/issues/53137.

7

Glad it helped. Makes so much sense to dedup the logs. Thanks for pushing out the bugfix.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.