elastic search 修改日志级别为warn

案发现场

测试同学压测接口，导致es疯狂超时

排查

登录es服务器，打开日志，发现全部是超时日志，再往上看发现全是debug级别的日志，而且连每条query语句都打印了出来。

.... 
....
...
          "max_expansions" : 50,
              "fuzzy_transpositions" : true,
              "lenient" : false,
              "zero_terms_query" : "NONE",
              "boost" : 0.1
            }
          }
        }
      ],
      "disable_coord" : false,
      "adjust_pure_negative" : true,
      "boost" : 1.0
    }
  },
  "_source" : {
    "includes" : [
      "aId",
      "an"
    ],
    "excludes" : [ ]
  },
  "sort" : [
    {
      "_score" : {
        "order" : "desc"
      }
    },
    {
      "dn" : {
        "order" : "desc"
      }
    }
  ]
:

一次请求1000个导致了拒绝接受新的请求

org.elasticsearch.common.util.concurrent.EsRejectedExecutionException: rejected execution of org.elasticsearch.transport.TransportService$7@1ad069ff on EsThr
eadPoolExecutor[search, queue capacity = 1000, org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor@41328b39[Running, pool size = 13, active threads
 = 13, queued tasks = 1000, completed tasks = 48895]]
        at org.elasticsearch.common.util.concurrent.EsAbortPolicy.rejectedExecution(EsAbortPolicy.java:50) ~[elasticsearch-5.4.1.jar:5.4.1]
        at java.util.concurrent.ThreadPoolExecutor.reject(ThreadPoolExecutor.java:823) ~[?:1.8.0_45]
        at java.util.concurrent.ThreadPoolExecutor.execute(ThreadPoolExecutor.java:1369) ~[?:1.8.0_45]
        at org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor.doExecute(EsThreadPoolExecutor.java:94) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor.execute(EsThreadPoolExecutor.java:89) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.transport.TransportService.sendLocalRequest(TransportService.java:623) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.transport.TransportService.access$000(TransportService.java:73) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.transport.TransportService$3.sendRequest(TransportService.java:133) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.transport.TransportService.sendRequestInternal(TransportService.java:569) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.transport.TransportService$$Lambda$1050/1614238.sendRequest(Unknown Source) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.transport.TransportService.sendRequest(TransportService.java:502) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.transport.TransportService.sendChildRequest(TransportService.java:529) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.transport.TransportService.sendChildRequest(TransportService.java:520) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.action.search.SearchTransportService.sendExecuteQuery(SearchTransportService.java:146) [elasticsearch-5.4.1.jar:5.4.1]
        at org.elasticsearch.action.search.SearchQueryThenFetchAsyncAction.executePhaseOnShard(SearchQueryThenFetchAsyncAction.java:74) [elasticsearch-5.4.1.
jar:5.4.1]

查看当前线程池配置：

curl -XGET 'http://10.20.30.40:9200/_nodes/thread_pool?pretty'

从ElasticSearch5.0 开始，无法通过api更改线程池，需要更改elasticsearch.yml并重启才能生效配置

thread_pool.search.queue_size: 500
#queue_size允许控制没有线程执行它们的挂起请求队列的初始大小。
thread_pool.search.size: 200
#size参数控制线程数，默认为核心数乘以5。
thread_pool.search.min_queue_size:10
#min_queue_size设置控制queue_size可以调整到的最小量。
thread_pool.search.max_queue_size: 1000
#max_queue_size设置控制queue_size可以调整到的最大量。
thread_pool.search.auto_queue_frame_size: 2000
#auto_queue_frame_size设置控制在调整队列之前进行测量的操作数。它应该足够大，以便单个操作不会过度偏向计算。
thread_pool.search.target_response_time: 6s
#target_response_time是时间值设置，指示线程池队列中任务的目标平均响应时间。如果任务通常超过此时间，则将调低线程池队列以拒绝任务。

修改为warn级别的

Elasticsearch 会输出很多日志，都放在 ES_HOME/logs 目录下。默认的日志记录等级是 INFO 。它提供了适度的信息，但是又设计好了不至于让你的日志太过庞大。

当调试问题的时候，特别是节点发现相关的问题（因为这个经常依赖于各式过于繁琐的网络配置），提高日志记录等级到 DEBUG 是很有帮助的。

你可以修改log4j2.properties 文件然后重启你的节点——但是这样做即繁琐还会导致不必要的宕机时间。作为替代，你可以通过 cluster-settings API 更新日志记录级别，就像我们前面刚学过的那样。

要实现这个更新，选择你感兴趣的日志器，然后在前面补上 logger. 。对根日志器你可以用 logger._root 来表示。

PUT /_cluster/settings
{
"transient": {
 "<name of logging hierarchy>": "<level>"
}
}

例如：

curl -XPUT http://10.20.30.40:9200/_cluster/settings -d'
{
    "transient" : {
      "logger.discovery ": "WARN"
    }
}'

设置生效，Elasticsearch 将开始输出 discovery 模块的 WARN级别的日志。

{"acknowledged":true,"persistent":{},"transient":{"logger":{"org":{"elasticsearch":{"indices":{"recovery":"WARN"}}}}}}

参考 https://www.elastic.co/guide/en/elasticsearch/reference/5.1/breaking_50_settings_changes.html#_forbid_changing_of_thread_pool_types http://doc.codingdict.com/elasticsearch/437/ https://elasticsearch.cn/article/32