50 lines
1.7 KiB
Plaintext
50 lines
1.7 KiB
Plaintext
[float]
|
|
[[breaking_70_logging_changes]]
|
|
=== Logging changes
|
|
|
|
//NOTE: The notable-breaking-changes tagged regions are re-used in the
|
|
//Installation and Upgrade Guide
|
|
|
|
//tag::notable-breaking-changes[]
|
|
|
|
// end::notable-breaking-changes[]
|
|
|
|
[float]
|
|
==== New JSON format log files in `log` directory
|
|
|
|
Elasticsearch now will produce additional log files in JSON format. They will be stored in `*.json` suffix files.
|
|
Following files should be expected now in log directory:
|
|
* ${cluster_name}_server.json
|
|
* ${cluster_name}_deprecation.json
|
|
* ${cluster_name}_index_search_slowlog.json
|
|
* ${cluster_name}_index_indexing_slowlog.json
|
|
* ${cluster_name}.log
|
|
* ${cluster_name}_deprecation.log
|
|
* ${cluster_name}_index_search_slowlog.log
|
|
* ${cluster_name}_index_indexing_slowlog.log
|
|
* ${cluster_name}_audit.json
|
|
* gc.log
|
|
|
|
Note: You can configure which of these files are written by editing `log4j2.properties`.
|
|
|
|
[float]
|
|
==== Log files ending with `*.log` deprecated
|
|
Log files with the `.log` file extension using the old pattern layout format
|
|
are now considered deprecated and the newly added JSON log file format with
|
|
the `.json` file extension should be used instead.
|
|
Note: GC logs which are written to the file `gc.log` will not be changed.
|
|
|
|
[float]
|
|
==== Docker output in JSON format
|
|
|
|
All Docker console logs are now in JSON format. You can distinguish logs streams with the `type` field.
|
|
|
|
[float]
|
|
==== Audit plaintext log file removed, JSON file renamed
|
|
|
|
Elasticsearch no longer produces the `${cluster_name}_access.log` plaintext
|
|
audit log file. The `${cluster_name}_audit.log` files also no longer exist; they
|
|
are replaced by `${cluster_name}_audit.json` files. When auditing is enabled,
|
|
auditing events are stored in these dedicated JSON log files on each node.
|
|
|