英文:
Search slowlog in JSON format is truncating the query
问题
I am on Elasticsearch 7.10.0 and recently I have changed the slowlogs format from plaintext to json anticipating that large query truncation issue will be resolved automatically in the json format. But I am still seeing this issue in the json format as well for the search slow logs.
Sharing a line from the json slowlog here:
{
"type": "elasticsearch.search_slowlog",
"timestamp": "2023-08-01T02:22:21,242Z",
"level": "WARN",
"component": "i.s.s.query",
"cluster.name": "prod-es6-story",
"node.name": "data-0-x.x.x.x",
"message": "[complete-tagged-2023-07-v3][139] took[5.5s], took_millis[5583], total_hits[6 hits], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[300], source[{...省略部分...}],
"adjust_pure_negative": true,
"minimum_should_match": "1",
"boost": 1.0
}
英文:
I am on Elasticsearch 7.10.0 and recently I have changed the slowlogs format from plaintext to json anticipating that large query truncation issue will be resolved automatically in the json format. But I am still seeing this issue in the json format as well for the search slow logs.
Sharing a line from the json slowlog here:
{
"type": "elasticsearch.search_slowlog",
"timestamp": "2023-08-01T02:22:21,242Z",
"level": "WARN",
"component": "i.s.s.query",
"cluster.name": "prod-es6-story",
"node.name": "data-0-x.x.x.x",
"message": "[complete-tagged-2023-07-v3][139] took[5.5s], took_millis[5583], total_hits[6 hits], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[300], source[{\"size\":0,\"query\":{\"constant_score\":{\"filter\":{\"bool\":{\"filter\":[{\"terms\":{\"tags_profile\":[\"lGk\"],\"boost\":1.0}},{\"range\":{\"created_at\":{\"from\":null,\"to\":null,\"include_lower\":true,\"include_upper\":true,\"boost\":1.0}}}],\"must_not\":[{\"bool\":{\"filter\":[{\"bool\":{\"must_not\":[{\"terms\":{\"tags_account_exclusion\":[\"58175874c2df937f11e23a13\",\"dO\"],\"boost\":1.0}}],\"should\":[{\"term\":{\"account_scope\":{\"value\":\"58175874c2df937f11e23a13\",\"boost\":1.0}}},{\"bool\":{\"must_not\":[{\"exists\":{\"field\":\"account_scope\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"filter\":[{\"terms\":{\"source_type\":[\"twitter\",\"news\",\"blogs\",\"facebook\",\"reddit\",\"videos\",\"lexis_nexis\",\"broadcast\",\"instagram\",\"forum\",\"qa\",\"review\"],\"boost\":1.0}},{\"bool\":{\"should\":[{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"match_phrase\":{\"text\":{\"query\":\"#CVSHealth\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSHealth\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvshealth\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvspharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"caremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvscaremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#cvscaremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"minuteclinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvsminuteclinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Health\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Pharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSPharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSPharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Caremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSCaremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSCaremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"Caremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#Caremark\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Minute Clinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSMinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSMinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS MinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"MinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#MinuteClinic\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Payor Solutions\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSPayorSolutions\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSPayorSolutions\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Speciality\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSSpeciality\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSSpeciality\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"SilverScript\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#SilverScript\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"MyChart\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#MyChart\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVS Caremark Specialty RX\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"CVSCaremarkSpecialtyRX\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVSCaremarkSpecialtyRX\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#cvsdelivery\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#CVS/Pharmacy\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"cvs\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#cvs\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text\":{\"query\":\"#cvshealth\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"filter\":[{\"term\":{\"source_type\":{\"value\":\"twitter\",\"boost\":1.0}}},{\"terms\":{\"author_username\":[\"@cvsinaction\",\"@cvshealth\",\"@cvspharmacy\",\"@minuteclinic\",\"@cvshealthpbm\",\"@silverscriptpdp\"],\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"filter\":[{\"term\":{\"source_type\":{\"value\":\"twitter\",\"boost\":1.0}}},{\"terms\":{\"author_mentions\":[\"cvshealth\",\"cvsinaction\",\"cvspharmacy\",\"minuteclinic\",\"cvshealthpbm\",\"silverscriptpdp\"],\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"match_phrase\":{\"text.raw\":{\"query\":\"CVS\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text.raw\":{\"query\":\"#CVS\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}},{\"match_phrase\":{\"text.raw\":{\"query\":\"@CVS\",\"slop\":0,\"zero_terms_query\":\"NONE\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"terms\":{\"page_id\":[\"658739734196897\",\"92979593115\",\"94231766381\"],\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.htlaehsvc.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.htlaehsvc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.svc.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.svc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.kramerac.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.kramerac\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.htlaehsvc.snoitulosroyap.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.htlaehsvc.snoitulosroyap\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.ytlaicepssvc.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.ytlaicepssvc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.tpircsrevlis.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.tpircsrevlis\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.tnadrocca.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.tnadrocca\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.tnadrocca.trahcym.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.tnadrocca.trahcym\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"links_domain_reversed\":{\"wildcard\":\"moc.xrytlaicepskrameracsvc.*\",\"boost\":1.0}}},{\"term\":{\"links_domain_reversed\":{\"value\":\"moc.xrytlaicepskrameracsvc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}}],\"adjust_pure_negative\":true,\"boost\":1.0}},{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.htlaehsvc.*\",\"boost\":1.0}}},{\"term\":{\"story_domain_reversed\":{\"value\":\"moc.htlaehsvc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.svc.*\",\"boost\":1.0}}},{\"term\":{\"story_domain_reversed\":{\"value\":\"moc.svc\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.kramerac.*\",\"boost\":1.0}}},{\"term\":{\"story_domain_reversed\":{\"value\":\"moc.kramerac\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.htlaehsvc.snoitulosroyap.*\",\"boost\":1.0}}},{\"term\":{\"story_domain_reversed\":{\"value\":\"moc.htlaehsvc.snoitulosroyap\",\"boost\":1.0}}}],\"adjust_pure_negative\":true,\"minimum_should_match\":\"1\",\"boost\":1.0}},{\"bool\":{\"should\":[{\"wildcard\":{\"story_domain_reversed\":{\"wildcard\":\"moc.ytlaic",
"cluster.uuid": "euyJJHiETH-tyAIYZ3VX0g",
"node.id": "EosB5XtZTUuS92he1mPYEw"
}
I was expecting that moving away from plain text format to json based format will not truncate the large queries in the search slow log.
log4j config:
appender.index_search_slowlog_rolling.type = RollingFile
appender.index_search_slowlog_rolling.name = index_search_slowlog_rolling
appender.index_search_slowlog_rolling.fileName = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog.json
appender.index_search_slowlog_rolling.layout.type = ESJsonLayout
appender.index_search_slowlog_rolling.layout.type_name = elasticsearch.search_slowlog
appender.index_search_slowlog_rolling.filePattern = ${sys:es.logs.base_path}${sys:file.separator}${sys:es.logs.cluster_name}_index_search_slowlog-%d{yyyy-MM-dd}-%i.json.gz
appender.index_search_slowlog_rolling.policies.type = Policies
appender.index_search_slowlog_rolling.policies.size.type = SizeBasedTriggeringPolicy
appender.index_search_slowlog_rolling.policies.size.size = 200MB
appender.index_search_slowlog_rolling.policies.time.type = TimeBasedTriggeringPolicy
appender.index_search_slowlog_rolling.policies.time.interval = 1
appender.index_search_slowlog_rolling.policies.time.modulate = true
logger.index_search_slowlog_rolling.name = index.search.slowlog
logger.index_search_slowlog_rolling.level = ${env:LOG_LEVEL_SLOWLOG:-trace}
logger.index_search_slowlog_rolling.appenderRef.index_search_slowlog_rolling.ref = index_search_slowlog_rolling
logger.index_search_slowlog_rolling.additivity = false
答案1
得分: 1
> appender.index_search_slowlog_rolling.layout.type = ESJsonLayout
问题在于 ESJsonLayout 中有10000个字符硬编码，似乎没有明显的方法可以更改这个行为。
一个潜在的解决方案是创建子类继承 ESJsonLayout 并将其用作自定义编码器。
英文:
> appender.index_search_slowlog_rolling.layout.type = ESJsonLayout
The issue is that the ESJsonLayout has 10000 characters hardcoded and there's no apparent way of changing this behavior.
One potential solution is to subclass ESJsonLayout and use it as your custom encoder.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论