Will increasing Elasticsplunk application timeout resolve this error?

splunkcol — Fri, 03 Mar 2023 16:37:50 GMT

Hello
I am currently managing a hybrid between Splunk and ELK (Elastisearch Logstash Kibana).

Logs supporting syslog protocol are sent to ELK and logs from other sources directly to windows via agent.

A plugin called Elasticsplunk has been installed and is stored in the path /splunk/splunk/etc/apps/elasticsplunk/.

Currently I am getting the following error message and I would like you to please help me if you know in which configuration file I increase the timeout

External search command 'ess' returned error code 1. Script output = "error_message=ConnectionTimeout at "/var2/splunk/splunk/etc/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'localhost', port=9200): Read timed out. (read timeout=60)) ".”

Re: Elasticsplunk application increase timeout

Tom_Lundie — Thu, 02 Mar 2023 22:31:01 GMT

EDIT: For Elastic Python (v6)

This project has been archived on GitHub so you are quite unlikely to get support from the creator.
Looking through the code, there is no timeout argument for the ess command, so not a lot you can do on the Splunk-side.

If you're happy to have a go at editing the code, then the Elasticsearch.search method in the Elastic Python SDK (v6) takes a timeout argument. Have a go at adding it under line 266 in ./elasticsplunk/bin/elasticsplunk.py:

            res = esclient.search(index=config[KEY_CONFIG_INDEX],
                                  size=config[KEY_CONFIG_LIMIT],
                                  _source_include=config[KEY_CONFIG_FIELDS],
                                  doc_type=config[KEY_CONFIG_SOURCE_TYPE],
                                  body=body)

Add the timeout argument as follows (don't forget the comma at the end of the body line):

            res = esclient.search(index=config[KEY_CONFIG_INDEX],
                                  size=config[KEY_CONFIG_LIMIT],
                                  _source_include=config[KEY_CONFIG_FIELDS],
                                  doc_type=config[KEY_CONFIG_SOURCE_TYPE],
                                  body=body,
                                  timeout=600)

FYI, I haven't tested this because I don't have elastic, but looking through the code, I think this will work. There are also some elastic add-ons on Splunkbase that might be worth checking out to see if they're actively supported?

topic Will increasing Elasticsplunk application timeout resolve this error? in Splunk Search

Will increasing Elasticsplunk application timeout resolve this error?

Re: Elasticsplunk application increase timeout