topic Re: How to increase elastic search timeout? in Splunk Search

How to increase elastic search timeout?

ahmadsaadwarrai — Thu, 20 Jun 2019 23:45:35 GMT

Sometimes my search gets fail and unable to fetch data because of below error:

ConnectionTimeout at "/opt/splunk/etc/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer1.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer2.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))

Does anyone know how to fine tune or increase this timeout settings?

Re: How to increase elastic search timeout?

MuS — Fri, 21 Jun 2019 00:50:53 GMT

Hi there, I have removed the last octet of the IP's.

cheers, MuS

Re: How to increase elastic search timeout?

MuS — Fri, 21 Jun 2019 21:55:37 GMT

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

Re: How to increase elastic search timeout?

ahmadsaadwarrai — Sun, 23 Jun 2019 23:24:04 GMT

Thanks MuS, I have updated the http_urllib3.py script by myself and changed timeout from 10s to 30s.