不论是数据库还是搜索引擎，对于问题的排查，开启慢查询日志是十分必要的，ES 开启慢查询的方式有多种，但是最常用的是调用模板 API 进行全局设置：

    1. PUT  /_template/{TEMPLATE_NAME}
    2. {
    4.   "template":"{INDEX_PATTERN}",
    5.   "settings" : {
    6.     "index.indexing.slowlog.level": "INFO",
    7.     "index.indexing.slowlog.threshold.index.warn": "10s",
    8.     "index.indexing.slowlog.threshold.index.info": "5s",
    9.     "index.indexing.slowlog.threshold.index.debug": "2s",
    10.     "index.indexing.slowlog.threshold.index.trace": "500ms",
    11.     "index.indexing.slowlog.source": "1000",
    12.     "index.search.slowlog.level": "INFO",
    13.     "index.search.slowlog.threshold.query.warn": "10s",
    14.     "index.search.slowlog.threshold.query.info": "5s",
    15.     "index.search.slowlog.threshold.query.debug": "2s",
    16.     "index.search.slowlog.threshold.query.trace": "500ms",
    17.     "index.search.slowlog.threshold.fetch.warn": "1s",
    18.     "index.search.slowlog.threshold.fetch.info": "800ms",
    19.     "index.search.slowlog.threshold.fetch.debug": "500ms",
    20.     "index.search.slowlog.threshold.fetch.trace": "200ms"
    21.   },
    22.   "version"  : 1
    23. }
    25. PUT {INDEX_PAATERN}/_settings
    26. {
    27.     "index.indexing.slowlog.level": "INFO",
    28.     "index.indexing.slowlog.threshold.index.warn": "10s",
    29.     "index.indexing.slowlog.threshold.index.info": "5s",
    30.     "index.indexing.slowlog.threshold.index.debug": "2s",
    31.     "index.indexing.slowlog.threshold.index.trace": "500ms",
    32.     "index.indexing.slowlog.source": "1000",
    33.     "index.search.slowlog.level": "INFO",
    34.     "index.search.slowlog.threshold.query.warn": "10s",
    35.     "index.search.slowlog.threshold.query.info": "5s",
    36.     "index.search.slowlog.threshold.query.debug": "2s",
    37.     "index.search.slowlog.threshold.query.trace": "500ms",
    38.     "index.search.slowlog.threshold.fetch.warn": "1s",
    39.     "index.search.slowlog.threshold.fetch.info": "800ms",
    40.     "index.search.slowlog.threshold.fetch.debug": "500ms",
    41.     "index.search.slowlog.threshold.fetch.trace": "200ms"
    42. }

    这样，在日志目录下的慢查询日志就会有输出记录必要的信息了。

    1. {CLUSTER_NAME}_index_indexing_slowlog.log
    2. {CLUSTER_NAME}_index_search_slowlog.log