本地Elasticsearch日志位置及请求参数/URL查看方法（macOS Mojave）

Hey there! Let's tackle your Elasticsearch questions for macOS Mojave one by one:

The exact path depends on how you installed Elasticsearch:

• If you used Homebrew: Logs are stored in /usr/local/var/log/elasticsearch/. The main log file is typically named elasticsearch.log, and you might also find additional logs like slow query logs here.
• If you installed manually (downloaded and extracted the tarball): Logs live in the logs subdirectory of your Elasticsearch installation folder. For example, if you extracted it to ~/elasticsearch, the path would be ~/elasticsearch/logs/elasticsearch.log.

You can quickly view real-time log entries using tail in Terminal:

# For Homebrew installs
tail -f /usr/local/var/log/elasticsearch/elasticsearch.log

# For manual installs (adjust path to match your setup)
tail -f ~/elasticsearch/logs/elasticsearch.log

To see full details of incoming requests to your local ES instance (port 9200), you have two reliable options:

Option 1: Enable HTTP Access Logs in Elasticsearch #

This lets Elasticsearch log every incoming HTTP request directly to its main log file:

1. Open your Elasticsearch config file:
   • Homebrew install: /usr/local/etc/elasticsearch/elasticsearch.yml
   • Manual install: <your-es-install-dir>/config/elasticsearch.yml
2. Add or update the following line to define an Apache-style access log pattern (the %r component captures the full request line including method, URL, and parameters):

   http.log.pattern: "%h %l %u %t \"%r\" %>s %b %D"
   

3. Restart Elasticsearch to apply the change:

   # Homebrew
   brew services restart elasticsearch
   
   # Manual install (stop first, then start)
   pkill -f elasticsearch
   <your-es-install-dir>/bin/elasticsearch
   

4. Now, watch the log file with tail -f as mentioned earlier—you'll see every incoming request's URL and parameters logged clearly.

Option 2: Use tcpdump to Capture Local Traffic #

If you don't want to modify ES config or restart the service, use tcpdump to sniff traffic on the loopback interface (since your app connects locally):

sudo tcpdump -i lo0 port 9200 -A

• -i lo0: Targets the local loopback interface (isolates traffic between your app and local ES)
• -A: Prints packet content in ASCII, making request URLs and parameters easy to read

You'll see raw HTTP request lines like GET /my-index/_search?q=foo HTTP/1.1 along with request headers and body content.

内容的提问来源于stack exchange，提问作者Surya