A 400 error indicates that the client made an illegal request (hence the illegal_argument_exception).
The bigger concern to me is that it is a TransportError and the port listed after the IP is 9300, which is the Transport Protocol, and not the normal HTTP/REST protocol which Curator uses to interact with Elasticsearch. This suggests to me that Curator successfully made a request to a node (using HTTP), but the node-to-node traffic replied with that error. indices:admin/delete suggests that the user Curator is connecting as does not have the proper credentials to perform the delete.
These are my off-the-top-of-my-head speculations. Without more debug logging, I won't be able to do more. You may even need to set blacklist: [] (in addition to loglevel: DEBUG) to not hide the elasticsearch request log lines.
The long story short version is that the HTTP pool you are connecting to has a timeout value. If you set the timeout higher than 30 in your client definition (I understand you're using a lambda), and that still happens, then there's nothing I can do for you.
The timeout value goes into where you setup the client, e.g. client = elasticsearch.Elasticsearch(host=xxx, port=xxx, timeout=30).
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.