Logging

ElasticSPL logs to various files read by Splunk. The logging configuration can be found in the Logging tab. All logs are indexed into the _internal index and have a sourcetype starting with elasticspl:.

Logging Levels

Please note that setting the logging level to DEBUG will result in a high amount of logs. This can result in performance issues. Only set the logging level to DEBUG if requested by the ElasticSPL support and only temporarily.

To see all logs in Splunk, run the following search:

index="_internal" sourcetype="elasticspl:*"