elasticsearch 5.2以上如何开启慢查询日志？

收到个需求要开启 慢查询日志 我这边elastic 版本5.2 查了一下官网 提示我 在yml里配置
index.search.slowlog.threshold.query.warn：10s
index.search.slowlog.threshold.query.info:5s
index.search.slowlog.threshold.query.debug：2s
index.search.slowlog.threshold.query.trace ：500ms
配置之后 启动 提示报错
Found index level settings on node level configuration.

Since elasticsearch 5.x index level settings can NOT be set on the nodes
configuration like the elasticsearch.yaml, in system properties or command line
arguments.In order to upgrade all indices the settings must be updated via the
/${index}/_settings API. Unless all settings are dynamic all indices must be closed
in order to apply the upgradeIndices created in the future should use index templates
to set default values.

Please ensure all required values are updated on all indices by executing:

curl -XPUT 'http://localhost:9200/_all/_settings?preserve_existing=true' -d '{
"index.search.slowlog.threshold.query.debug" : "2s",
"index.search.slowlog.threshold.query.info" : "5s",
"index.search.slowlog.threshold.query.trace" : "500ms",
"index.search.slowlog.threshold.query.warn" : "10s"
}'

似乎5以上不在配置文件里配置了
尝试curl

$ curl -XPUT 'http://172.16.84.179:9200/_all/_settings?preserve_existing=true' -d '{
"index.search.slowlog.threshold.query.debug" : "2s",
"index.search.slowlog.threshold.query.info" : "5s",
"index.search.slowlog.threshold.query.trace" : "500ms",
"index.search.slowlog.threshold.query.warn" : "10s"
}'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}[ devops@172.16.84.179 ] [ /home/devops ]


请问各位大神 到底该怎么正确开启慢查询日志