How to enable slowlogs for all indices and tweak slowlog logger level

elasticsearch_slowlog_for_all_indices.md

Slowlog thresholds for all indices

Add slowlog thresholds for all indices

PUT /_all/_settings 
{
"index.search.slowlog.threshold.query.warn": "10s",
"index.search.slowlog.threshold.query.info": "5s",
"index.search.slowlog.threshold.query.debug": "2s",
"index.search.slowlog.threshold.query.trace": "500ms",

"index.search.slowlog.threshold.fetch.warn": "10s",
"index.search.slowlog.threshold.fetch.info": "5s",
"index.search.slowlog.threshold.fetch.debug": "2s",
"index.search.slowlog.threshold.fetch.trace": "500ms"
}

After investigation rollback to defaults

PUT /_all/_settings 
{
"index.search.slowlog.threshold.query.warn": null,
"index.search.slowlog.threshold.query.info": null,
"index.search.slowlog.threshold.query.debug": null,
"index.search.slowlog.threshold.query.trace": null,

"index.search.slowlog.threshold.fetch.warn": null,
"index.search.slowlog.threshold.fetch.info": null,
"index.search.slowlog.threshold.fetch.debug": null,
"index.search.slowlog.threshold.fetch.trace": null
}

Tweak slowlog logger level to suit your needs

#### Add slowlog logger in cluster settings (transient -> not conserved after reboot)

PUT _cluster/settings
{
  "transient" : {
    "logger.index.search.slowlog" : "DEBUG",
    "logger.index.indexing.slowlog" : "DEBUG"
  }
}

Rollback to defaults (from log4j logger.index_indexing_slowlog.level = trace)

PUT _cluster/settings
{
  "transient" : {
    "logger.index.search.slowlog" : null,
    "logger.index.indexing.slowlog" : null
  }
}