性能分析与慢查询日志

Guessing at performance fixes wastes time. Elasticsearch gives you two precise tools: the Profile API for dissecting a single query, and slow logs for catching expensive operations in production.

Add "profile": true to any search request. Elasticsearch returns a detailed timing breakdown of how the query executed on each shard.

The profile output lists each Lucene query and the time spent in phases like build_scorer, next_doc, and score. A surprisingly slow phase points you straight to the culprit.

Watch the rewrite_time. Wildcard, prefix, and range queries can rewrite into thousands of terms, inflating this number. If rewrite dominates, reconsider the query type or use a keyword/edge-ngram field.

The profile output also has an aggregations section. It shows initialize, collect, and build_aggregation times, helping you spot a costly high-cardinality terms aggregation.

Profiling adds overhead and does not capture network or coordination time. Use it for relative comparison between query versions, not as an absolute production latency figure.

The slow log records queries that exceed configurable time thresholds, per shard. It separates the query phase from the fetch phase and uses warn/info/debug/trace levels.

A parallel indexing slow log catches documents that take too long to index, useful for spotting expensive pipelines or oversized documents.

Slow log thresholds apply per shard, not per request. A query slow on one shard but fast overall will still be logged for that shard, helping you find a single hot or unbalanced shard.

Once you identify a slow pattern, common fixes are: add a filter to narrow the dataset, replace heavy wildcard queries, increase shard count for hot indices, or pre-aggregate data. Always re-profile to confirm the gain.

Production loop: slow log surfaces a bad query, you reproduce it with the Profile API, identify the costly phase, apply a fix, and verify. This data-driven cycle beats guesswork every time.

You learned to diagnose performance:

• The Profile API breaks down query and aggregation timings phase by phase.
• Watch rewrite_time for expanding wildcard/range queries.
• Search and indexing slow logs catch expensive operations per shard in production.
• Follow a measure-fix-verify loop instead of guessing.