Graylog2 / Graylog2/graylog2-server

Elasticsearch getting stuck on long running queries that are not canceled

Open
#4,614 2 comments 2 reactions 0 assignees View on GitHub
elasticsearch feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Recently we notice our Graylog instance getting stuck regularly. Stuck means: Process buffer 100%, Input and Output buffer empty, Disk Journal piling up, no / few messages written to Elasticsearch.

Further investigation shows several long running queries in ES - usually with empty filter, time frame from 1-1-1970 until now, all indices (we have several hundreds of them). Fix is cancelling all those queries from ES, the ES starts consuming messages again immediately after cancel operation.

Listing queries: curl -XGET 'localhost:9200/_tasks?pretty&detailed'
Canceling queries: curl -XPOST 'localhost:9200/_tasks/_cancel?actions=*search

The search in the graylog WebUI times out as specified in the server.conf using elasticsearch_request_timeout.

## Expected Behavior

Query in ES should by canceled / timeout as specified in elasticsearch_request_timeout

## Current Behavior

WebUI shows error message, but search query is still running in ES. Several of those queries leave ES stuck.

## Possible Solution

Cancel query in ES or set timeout on ES query.

## Steps to Reproduce (for bugs)

1. set search time frame to "Search in all messages"
2. leave query field empty
3. start search
4. check running queries in ES using ES API

## Context

## Your Environment

1 Graylog server
1 ES master node
2 ES data nodes

* Graylog Version: 2.4.3
* Elasticsearch Version: 5.6.8 (and previously on 2.5.x)
* MongoDB Version: 3.6.2
* Operating System: Centos 7
* Browser version: Chrome / Firefox

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.