Splunk Search

How to increase elastic search timeout?

ahmadsaadwarrai
Explorer

Sometimes my search gets fail and unable to fetch data because of below error:

ConnectionTimeout at "/opt/splunk/etc/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer1.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer2.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))

Does anyone know how to fine tune or increase this timeout settings?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

ahmadsaadwarrai
Explorer

Thanks MuS, I have updated the http_urllib3.py script by myself and changed timeout from 10s to 30s.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi there, I have removed the last octet of the IP's.

cheers, MuS

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!