From a59c39b06742b29672d6a1022ae1595ecd67707a Mon Sep 17 00:00:00 2001 From: Matt Riedemann Date: Mon, 27 Jan 2014 07:31:20 -0800 Subject: [PATCH] Document the INFO+ log level query restriction We only index on INFO and higher log level messages and sometimes the only good thing to fingerprint in the logs is at DEBUG level, but that won't work with elastic-recheck right now, so we have to document the limitation. Change-Id: I89fc35bca9f99ffdb1a0a71d88d041ac2215dd9d --- README.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.rst b/README.rst index 9a57584b..95c9b984 100644 --- a/README.rst +++ b/README.rst @@ -55,6 +55,10 @@ further down the stack that can cause many tempest tests to fail. #. Given a transient bug that is seen during the gate, go through the logs (logs.openstack.org) and try to find a log that is associated with the failure. The closer to the root cause the better. + + Note that queries can only be written against INFO level and higher log + messages. This is by design to not overwhelm the search cluster. + #. Go to logstash.openstack.org and create an elastic search query to find the log message from step 1. To see the possible fields to search on click on an entry. Lucene query syntax is available at