Elasticsearch deprecation logs

ECE ECK Elastic Cloud Hosted Self Managed

Elasticsearch writes deprecation logs to the log directory. These logs record a message when you use deprecated Elasticsearch functionality. You can use the deprecation logs to update your application before upgrading Elasticsearch to a new major version.

By default, Elasticsearch rolls and compresses deprecation logs at 1GB. The default configuration preserves a maximum of five log files: four rolled logs and an active log.

Elasticsearch emits deprecation log messages at the CRITICAL level. Those messages are indicating that a used deprecation feature will be removed in a next major version. Deprecation log messages at the WARN level indicates that a less critical feature was used, it won’t be removed in next major version, but might be removed in the future.

To stop writing deprecation log messages, change the logging level:

 PUT /_cluster/settings {
  "persistent": {
    "logger.org.elasticsearch.deprecation": "OFF"
  }
}

Alternatively, in self-managed clusters, you can set logger.deprecation.level to OFF in log4j2.properties :

logger.deprecation.level = OFF

For more information on the available log levels, refer to Configuring logging levels.

You can identify what is triggering deprecated functionality if X-Opaque-Id was used as an HTTP header. The user ID is included in the X-Opaque-ID field in deprecation JSON logs.

{
  "type": "deprecation",
  "timestamp": "2019-08-30T12:07:07,126+02:00",
  "level": "WARN",
  "component": "o.e.d.r.a.a.i.RestCreateIndexAction",
  "cluster.name": "distribution_run",
  "node.name": "node-0",
  "message": "[types removal] Using include_type_name in create index requests is deprecated. The parameter will be removed in the next major version.",
  "x-opaque-id": "MY_USER_ID",
  "cluster.uuid": "Aq-c-PAeQiK3tfBYtig9Bw",
  "node.id": "D7fUYfnfTLa2D7y-xw6tZg"
}

Deprecation logs can be indexed into the .logs-deprecation.elasticsearch-default data stream when cluster.deprecation_indexing.enabled setting is set to true.

Deprecation logs are deduplicated based on a deprecated feature key and x-opaque-id so that if a feature is repeatedly used, it will not overload the deprecation logs. This applies to both indexed deprecation logs and logs emitted to log files. You can disable the use of x-opaque-id in throttling by changing cluster.deprecation_indexing.x_opaque_id_used.enabled to false. Refer to this class javadoc for more details.