I use Data Visuallizer in Machine Learning ( Kibana ) to load file log to Elasticsearch.
But I received the following the error
[timeout_exception] Aborting structure analysis during [full message Grok pattern field extraction] as it has taken longer than the timeout of [25s]
I want to increase time out [25s].
What configuration time should I change in the config file ?
Thanks you !
Unfortunately, setting the timeout is only available when using the API, and the Kibana UI does not expose this.
However, if you are having issues with a specific file, then we would love to see a version of this file (perhaps anonymize any pieces that you don't want to share).
Is this something you can share?
There are two likely reasons for the timeout:
- The input consists of many long and very similar messages, leading to huge numbers of fields in common between the lines
- Timestamp format determination took a long time due to some known problems and as a result most of the 25 seconds was spent on this
If it's reason 2 then https://github.com/elastic/elasticsearch/pull/41948 will help you, although that's only in version 7.3.0 and above.
As Rich said, if you can share an anonymized version of your input file we can say definitively why it was slow to analyze and whether any upcoming enhancements will help. Or even if you cannot anonymize the whole file, if you could just share a couple of anonymized messages from it that might give us a clue about what the problem is.
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.