Errno 110 App ElasticSearch Configuration

[johnteo]

I have been trying to troubleshoot this error for the Elasicsearch application. However, with or without credentials I have run into the same error output.

App 'Elasticsearch' started successfully (id: 157241367048) on asset: 'elastic'(id: 13)
Loaded action execution configuration
Connecting to 192.168.30150:9200...
Querying cluster health to check connectivity
Using authentication
Connection failed. Error string 'HTTPConnectionPool(host='192.168.30.150',port=9200): Max retries exceeded with url:/_cluster/health (Caused by NewConnectionError(':Failed to establish a new connection: [Errno 110] Connection timed out'))'. Test Connectivity Failed. No action executions found.

The above cycle then continues to repeat itself with the same output when undergoing Testing Connectivity.

[cblumer_splunk · Accepted solution]

a timeout error like this typically indicates a network connectivity issue preventing the connection (firewall/proxy) - I would recommend running some connection tests from the phantom host to your ES instance. netcat/telnet/traceroute are a good place to start troubleshooting.