Graylog2 / Graylog2/graylog2-server
Elasticsearch getting stuck on long running queries that are not canceled
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Recently we notice our Graylog instance getting stuck regularly. Stuck means: Process buffer 100%, Input and Output buffer empty, Disk Journal piling up, no / few messages written to Elasticsearch.
Further investigation shows several long running queries in ES - usually with empty filter, time frame from 1-1-1970 until now, all indices (we have several hundreds of them). Fix is cancelling all those queries from ES, the ES starts consuming messages again immediately after cancel operation.
Listing queries: curl -XGET 'localhost:9200/_tasks?pretty&detailed'
Canceling queries: curl -XPOST 'localhost:9200/_tasks/_cancel?actions=*search
The search in the graylog WebUI times out as specified in the server.conf using elasticsearch_request_timeout.
## Expected Behavior
Query in ES should by canceled / timeout as specified in elasticsearch_request_timeout
## Current Behavior
WebUI shows error message, but search query is still running in ES. Several of those queries leave ES stuck.
## Possible Solution
Cancel query in ES or set timeout on ES query.
## Steps to Reproduce (for bugs)
1. set search time frame to "Search in all messages"
2. leave query field empty
3. start search
4. check running queries in ES using ES API
## Context
## Your Environment
1 Graylog server
1 ES master node
2 ES data nodes
* Graylog Version: 2.4.3
* Elasticsearch Version: 5.6.8 (and previously on 2.5.x)
* MongoDB Version: 3.6.2
* Operating System: Centos 7
* Browser version: Chrome / Firefox
Contributor guide
Assessment
This issue has not been assessed yet.