Elasticsearch支持分片级别的慢查(查询或者获取)，这些记录到一个日志文件中，它有一些阀值参数设置，这些阀值是动态设置并且是针对索引设置的：

PUT http://localhost:9200/索引/_settings?pretty{"search.slowlog.threshold.query.warn": "1ms","search.slowlog.threshold.query.info": "1ms","search.slowlog.threshold.query.debug": "1ms","search.slowlog.threshold.query.trace": "1ms","search.slowlog.threshold.fetch.warn": "1s","search.slowlog.threshold.fetch.info": "800ms","search.slowlog.threshold.fetch.debug": "500ms","search.slowlog.threshold.fetch.trace": "200ms"}返回{"acknowledged" : true}

日志打印规则已经在log4j2配置好，如果需要修改可以具体参考log4j2.properties相关设置：https://logging.apache.org/log4j/2.x/manual/configuration.html#Properties

{"indexing.slowlog.threshold.index.warn": "10s","indexing.slowlog.threshold.index.info": "5s","indexing.slowlog.threshold.index.debug": "2s","indexing.slowlog.threshold.index.trace": "500ms"}

开始在配置文件配置上面阀值参数，报出以下异常：node settings must not contain any index level settings

描述的是es5不支持索引级别的配置，需要启动后通过接口设置，如果从es2迁移过来则这些配置需要通过接口重新设置。

参考：