Curator started reporting error in delete_indices 'An HTTP line is larger than 4096 bytes.'

(Mohammad Ramadan Abdel Hafiez) #1

Hello Friends,
I have ELK stack with curator installed to delete logs older than 365 days.
a script created is used to make this process under crontab job that used to delete these older than 365 days logs.
everything was going well for days and suddenly when checking the job logs I found it report and error as follow :
2018-05-21 13:02:19,057 INFO Preparing Action ID: 1, "delete_indices"
2018-05-21 13:02:19,067 INFO Trying Action ID: 1, "delete_indices": Delete indices older than 365 days (based on index name), for custom- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
2018-05-21 13:02:19,304 ERROR Failed to complete action: delete_indices. <class 'elasticsearch.exceptions.RequestError'>: TransportError(400, 'too_long_frame_exception', 'An HTTP line is larger than 4096 bytes.')
versions data as follow:
di@ELK-5:$ curl -XGET 'localhost:9200'
"name" : "QInEGiG",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "SEqBRvyiSjCBPJLpMBVgrg",
"version" : {
"number" : "5.6.5",
"build_hash" : "6a37571",
"build_date" : "2017-12-04T07:50:10.466Z",
"build_snapshot" : false,
"lucene_version" : "6.6.1"
"tagline" : "You Know, for Search"
curator, version 5.4.1
Any help guys, am network engineer and not a developer :frowning:

(Mohammad Ramadan Abdel Hafiez) #2

Solved by adding http.max_initial_line_length: 16kb to the ES yml config file.

(Aaron Mildenstein) #3

I'd like to know more about how this happened. Curator shouldn't experience this as there is code that tries to prevent chunks bigger than roughly 3K from being sent, because of this 4K limit. This code has been in place for a lot longer than Curator version 5.4.1 (the version you are using).

How large are your index names? Is there more log data than what you've provided?

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.