Live Debugging Elasticsearch


  • elasticsearch v5.6.7

Elasticsearch offers the capability to alter the log level at runtime, for troubleshooting. I got some problems with TLS and this was really helpful and the good thing: No cluster downtime! Elasticsearch uses Apache Log4j 2

Root Logger

Set log level for root logger. Fair warning trace will explode your logfiles.

PUT /_cluster/settings

Set log level for specific logger. Always prefix class names with logger. Set log level for the Apache HTTP client.

PUT /_cluster/settings
{"transient": {"logger.org.apache.http":"info"}}

Set log level for the commercial monitoring extension of elastic.

PUT /_cluster/settings
{"transient": {"logger.xpack.monitoring":"debug"}}

Logging per Index

A really cool feature is logging per index. For the index magic_index the trace information of the queries that take more than 100 milliseconds on that index are written to the <cluster>_index_search_slowlog.log file.

PUT /magic_index/_settings
  "index": {
    "search.slowlog.level": "trace",
    "search.slowlog.threshold.query.trace": "100ms"


Some sources for a more detailed explaination: