elastic search 修改日志级别为warn
案发现场
测试同学压测 接口，导致es疯狂超时
排查
登录es 服务器 ，打开日志，发现全部是超时日志，再往上看发现全是debug级别的日志，而且连每条query语句都打印了出来。
....
"max_expansions" : 50,
"fuzzy_transpositions" : true,
"lenient" : false,
"zero_terms_query" : "NONE",
"boost" : 0.1
"disable_coord" : false,
"adjust_pure_negative" : true,
"boost" : 1.0
"_source" : {
"includes" : [
"aId",
"excludes" : [ ]
"sort" : [
"_score" : {
"order" : "desc"
"dn" : {
"order" : "desc"
:一次请求1000个 导致了拒绝接受新的请求
org.elasticsearch.common.util.concurrent.EsRejectedExecutionException: rejected execution of org.elasticsearch.transport.TransportService$7@1ad069ff on EsThr
eadPoolExecutor[search, queue capacity = 1000, org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor@41328b39[Running, pool size = 13, active threads
= 13, queued tasks = 1000, completed tasks = 48895]]
at org.elasticsearch.common.util.concurrent.EsAbortPolicy.rejectedExecution(EsAbortPolicy.java:50) ~[elasticsearch-5.4.1.jar:5.4.1]
at java.util.concurrent.ThreadPoolExecutor.reject(ThreadPoolExecutor.java:823) ~[?:1.8.0_45]
at java.util.concurrent.ThreadPoolExecutor.execute(ThreadPoolExecutor.java:1369) ~[?:1.8.0_45]
at org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor.doExecute(EsThreadPoolExecutor.java:94) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor.execute(EsThreadPoolExecutor.java:89) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.transport.TransportService.sendLocalRequest(TransportService.java:623) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.transport.TransportService.access$000(TransportService.java:73) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.transport.TransportService$3.sendRequest(TransportService.java:133) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.transport.TransportService.sendRequestInternal(TransportService.java:569) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.transport.TransportService$$Lambda$1050/1614238.sendRequest(Unknown Source) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.transport.TransportService.sendRequest(TransportService.java:502) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.transport.TransportService.sendChildRequest(TransportService.java:529) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.transport.TransportService.sendChildRequest(TransportService.java:520) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.search.SearchTransportService.sendExecuteQuery(SearchTransportService.java:146) [elasticsearch-5.4.1.jar:5.4.1]
at org.elasticsearch.action.search.SearchQueryThenFetchAsyncAction.executePhaseOnShard(SearchQueryThenFetchAsyncAction.java:74) [elasticsearch-5.4.1.
jar:5.4.1]查看当前线程池配置：
curl -XGET 'http://10.20.30.40:9200/_nodes/thread_pool?pretty'
从ElasticSearch5.0 开始，无法通过api更改线程池，需要更改 elasticsearch .yml并重启才能生效配置
thread_pool.search.queue_size: 500
#queue_size允许控制没有线程执行它们的挂起请求队列的初始大小。
thread_pool.search.size: 200
#size参数控制线程数，默认为核心数乘以5。
thread_pool.search.min_queue_size:10
#min_queue_size设置控制queue_size可以调整到的最小量。
thread_pool.search.max_queue_size: 1000
#max_queue_size设置控制queue_size可以调整到的最大量。
thread_pool.search.auto_queue_frame_size: 2000
#auto_queue_frame_size设置控制在调整队列之前进行测量的操作数。它应该足够大，以便单个操作不会过度偏向计算。
thread_pool.search.target_response_time: 6s
#target_response_time是时间值设置，指示线程池队列中任务的目标平均响应时间。如果任务通常超过此时间，则将调低线程池队列以拒绝任务。修改为warn级别的
Elasticsearch 会输出很多日志，都放在 ES_HOME/logs 目录下。默认的日志记录等级是 INFO 。它提供了适度的信息，但是又设计好了不至于让你的日志太过庞大。
当调试问题的时候，特别是节点发现相关的问题（因为这个经常依赖于各式过于繁琐的网络配置），提高日志记录等级到 DEBUG 是很有帮助的。
你 可以 修改log4j2.properties 文件然后重启你的节点——但是这样做即繁琐还会导致不必要的宕机时间。作为替代，你可以通过 cluster-settings API 更新日志记录级别，就像我们前面刚学过的那样。
要实现这个更新，选择你感兴趣的日志器，然后在前面补上 logger. 。对根日志器你可以用 logger._root 来表示。
PUT /_cluster/settings
"transient": {
"<name of logging hierarchy>": "<level>"
}例如：
curl -XPUT http://10.20.30.40:9200/_cluster/settings -d'
"transient" : {