From d1621022097ad723a6a97940f0589af0df033c9d Mon Sep 17 00:00:00 2001
From: Steve Ban <48812298+julius-ban@users.noreply.github.com>
Date: Mon, 13 Jul 2026 10:00:31 +0900
Subject: [PATCH 1/2] Update CollectLogs.java

Update CollectLogs.java for collect slowlog.
---
 .../elastic/support/diagnostics/commands/CollectLogs.java   | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/main/java/co/elastic/support/diagnostics/commands/CollectLogs.java b/src/main/java/co/elastic/support/diagnostics/commands/CollectLogs.java
index c11b4f4a..0bd65e42 100644
--- a/src/main/java/co/elastic/support/diagnostics/commands/CollectLogs.java
+++ b/src/main/java/co/elastic/support/diagnostics/commands/CollectLogs.java
@@ -84,6 +84,12 @@ public void execute(DiagnosticContext context) {
             logListing = sysCmd.runCommand(logStatement).trim();
             fileList = extractFilesFromList(logListing, fileList, 3);
 
+            logStatement = logCalls.get("slowlog");
+            logStatement = logStatement.replace("{{CLUSTERNAME}}", clusterName);
+            logStatement = logStatement.replace("{{LOGPATH}}", logDir);
+            logListing = sysCmd.runCommand(logStatement).trim();
+            fileList = extractFilesFromList(logListing, fileList, 2);
+
             sysCmd.copyLogs(fileList, logDir, targetDir );
 
         } catch (Exception e) {

From 4962dc706ed6d3be86968eb43367ea025a0a9698 Mon Sep 17 00:00:00 2001
From: Steve Ban <48812298+julius-ban@users.noreply.github.com>
Date: Mon, 13 Jul 2026 10:08:46 +0900
Subject: [PATCH 2/2] Update diags.yml

Update diags.yml for slowlog
---
 src/main/resources/diags.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/main/resources/diags.yml b/src/main/resources/diags.yml
index 66d27bf8..6acff6cc 100644
--- a/src/main/resources/diags.yml
+++ b/src/main/resources/diags.yml
@@ -68,6 +68,7 @@ linuxOS:
     elastic: "ls -alt {{LOGPATH}} | grep -e '{{CLUSTERNAME}}.log' -e '{{CLUSTERNAME}}_server.json' | awk '{print $9}'"
     elastic-arc: "ls -alt {{LOGPATH}} | grep '{{CLUSTERNAME}}-.*-1.log.gz' | awk '{print $9}'"
     gc: "ls -alt {{LOGPATH}} |  awk '/gc/ {print $9}'"
+    slowlog: "ls -alt {{LOGPATH}} | grep 'slowlog.json' | awk '{print $9}'"
     kibana: "ls -alt /var/log/kibana/ |  awk '/.json|.log/ {print $9}'"
     kibana-default-path: "/var/log/kibana/"
 
@@ -88,6 +89,7 @@ macOS:
     elastic: "ls -alt {{LOGPATH}} | grep -e '{{CLUSTERNAME}}.log' -e '{{CLUSTERNAME}}_server.json' | awk '{print $9}'"
     elastic-arc: "ls -alt {{LOGPATH}} | grep '{{CLUSTERNAME}}-.*-1.log.gz' | awk '{print $9}'"
     gc: "ls -alt {{LOGPATH}} |  awk '/gc/ {print $9}'"
+    slowlog: "ls -alt {{LOGPATH}} | grep 'slowlog.json' | awk '{print $9}'"
     kibana: "ls -alt /var/log/kibana/ |  awk '/.json|.log/ {print $9}'"
     kibana-default-path: "/var/log/kibana/"
 
@@ -107,6 +109,7 @@ winOS:
     elastic: "dir /b  /l /o:-d /a:-d {{LOGPATH}}\\{{CLUSTERNAME}}.log"
     elastic-arc: "dir /b  /l /o:-d /a:-d {{LOGPATH}}\\{{CLUSTERNAME}}-*.log.gz"
     gc: "dir /l /b /o:-d /a:-d {{LOGPATH}}\\gc.log.*"
+    slowlog: "dir /b  /l /o:-d /a:-d {{LOGPATH}}\\*slowlog.json"
 
 docker-container-ids: "{{dockerPath}} ps -q"