Index Slow logs does not contain opaque ID (if used).

[itsx]

Elasticsearch Version

"version": { "number": "7.17.9", "build_flavor": "default", "build_type": "deb", "build_hash": "ef48222227ee6b9e70e502f0f0daa52435ee634d", "build_date": "2023-01-31T05:34:43.305517834Z", "build_snapshot": false, "lucene_version": "8.11.1", "minimum_wire_compatibility_version": "6.8.0", "minimum_index_compatibility_version": "6.0.0-beta1" }

Installed Plugins

analysis-icu, discovery-ec2, repository-s3

Java Version

bundled

OS Version

Ubuntu 22.04
Linux ip-10-0-42-122 5.15.0-1030-aws #34-Ubuntu SMP Mon Jan 23 20:14:51 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

Problem Description

Index Slow logs does not contain opaque ID if used.

Steps to Reproduce

1. Enable Index Slow logs (set trasholds to 0s)
2. Perform index or bulk index request with X-Opaque-Id header
3. Check events in Index Slow logs

Logs (if relevant)

Log event contains ID of the document (not Opaque ID): 'id': '63cf2bcb937ba9c6ee7a1dbd'

{'cluster.name': 'clusterXX',
 'cluster.uuid': 'XXX',
 'component': 'i.i.s.index',
 'doc_type': '_doc', 
 'id': '63cf2bcb937ba9c6ee7a1dbd',
 'level': 'WARN',
 'message': '[index_name/XXX]',
 'node.id': 'XXX',
 'node.name': 'node.XX.',
 'source': '{"seller":"..."}',
 'timestamp': '2023-03-28T01:45:03,962Z',
 'took': '505ms',
 'took_millis': '505',
 'type': 'index_indexing_slowlog'}

[elasticsearchmachine]

Pinging @elastic/es-core-infra (Team:Core/Infra)

[thecoop]

@itsx As mentioned in the docs, the id field is the user id performing the query. Is this what you're seeing?

[itsx]

@thecoop Unfortunately not. In my case the id contains the id of the indexed document (which is visible in the source field). For Search Slow logs everything is fine (id field is the user id performing the query). Problem is only with Index Slow logs.

[thecoop]

Ah, I see the issue. There's a behaviour difference between the index slow log and search slow log due to limitations in the index log execution context. This has been this way for several years, and is quite tricky to implement.

However, the documentation does need to be updated, so I've opened #94951 to make this clear in the docs.