Bonjour,
Je débute avec l'Elastic Stack et je viens de faire ma première installation :
- 3 data/master-eligible node avec 16Go de RAM (8Go pour la heap), 900Go de disque, 4CPU.
- 1 serveur avec Kibana + Grafana : 4Go de RAM, 50 Go de disque et 2 CPU.
- Elasticsearch et Kibana version 7.7.0.
- License Basic avec sécurité activée (avec https vers les nœuds elasticsearch)
Mon problème est que, à chaque fois que je fais une requête avec Kibana (onglet Discovery ou une visualisation), j'ai un request timeout au bout de 2-3 minutes en moyenne, puis les données s'affichent. Sachant que des requêtes plus compliquées se font en moins de 10 secondes avec Grafana.
L'erreur :
Error: Request Timeout
at Fetch._callee3$ (http://192.168.67.20:5601/bundles/commons.bundle.js:3:3997981)
at l (http://192.168.67.20:5601/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970406)
at Generator._invoke (http://192.168.67.20:5601/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970159)
at Generator.forEach.e.<computed> [as next] (http://192.168.67.20:5601/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:288:970763)
at asyncGeneratorStep (http://192.168.67.20:5601/bundles/commons.bundle.js:3:3991504)
at _next (http://192.168.67.20:5601/bundles/commons.bundle.js:3:3991815)
Après avoir regardé l'état de mes nœuds pendant la requète (avec la commande GET /_cat/nodes?v
) je me suis rendu compte que la quantité de données stockée en RAM (heap.percent) par Elasticsearch augmente beaucoup. Sachant que je n'ai qu'un seul index qui fait 1 Go.
Voici quelques données supplémentaires qui peuvent être utiles :
L'état de santé de mon cluster :
{
"cluster_name" : "siem",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 3,
"number_of_data_nodes" : 3,
"active_primary_shards" : 9,
"active_shards" : 18,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
Configuration Kibana:
server.host: 192.168.67.20
elasticsearch.hosts: ["https://192.168.67.17:9200","https://192.168.67.18:9200","https://192.168.67.19:9200"]
elasticsearch.username: "kibana"
elasticsearch.password: "*************"
elasticsearch.ssl.certificateAuthorities: [ "/etc/kibana/elasticsearch-ca.pem" ]
Quelques logs de Kibana :
May 26 10:59:29 kibana[15614]: {"type":"response","@timestamp":"2020-05-26T08:59:07Z","tags":[],"pid":15614,"method":"put","statusCode":408,"req":{"url":"/api/saved_objects/index-pattern/063794b0-9a92-11ea-baa0-0519acdea2b0","method":"put","headers":{"host":"192.168.67.20:5601","connection":"keep-alive","content-length":"625315","kbn-version":"7.7.0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36","content-type":"application/json","accept":"*/*","origin":"http://192.168.67.20:5601","referer":"http://192.168.67.20:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"},"remoteAddress":"192.168.64.53","userAgent":"192.168.64.53","referer":"http://192.168.67.20:5601/app/kibana"},"res":{"statusCode":408,"responseTime":21797,"contentLength":9},"message":"PUT /api/saved_objects/index-pattern/063794b0-9a92-11ea-baa0-0519acdea2b0 408 21797ms - 9.0B"}
May 26 10:59:41 kibana[15614]: {"type":"response","@timestamp":"2020-05-26T08:59:40Z","tags":[],"pid":15614,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"post","headers":{"host":"192.168.67.20:5601","connection":"keep-alive","content-length":"54","kbn-version":"7.7.0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36","content-type":"application/json","accept":"*/*","origin":"http://192.168.67.20:5601","referer":"http://192.168.67.20:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"},"remoteAddress":"192.168.64.53","userAgent":"192.168.64.53","referer":"http://192.168.67.20:5601/app/kibana"},"res":{"statusCode":200,"responseTime":52,"contentLength":9},"message":"POST /api/index_management/indices/reload 200 52ms - 9.0B"}
May 26 10:59:47 kibana[15614]: {"type":"response","@timestamp":"2020-05-26T08:59:29Z","tags":[],"pid":15614,"method":"put","statusCode":408,"req":{"url":"/api/saved_objects/index-pattern/063794b0-9a92-11ea-baa0-0519acdea2b0","method":"put","headers":{"host":"192.168.67.20:5601","connection":"keep-alive","content-length":"625315","kbn-version":"7.7.0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36","content-type":"application/json","accept":"*/*","origin":"http://192.168.67.20:5601","referer":"http://192.168.67.20:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"},"remoteAddress":"192.168.64.53","userAgent":"192.168.64.53","referer":"http://192.168.67.20:5601/app/kibana"},"res":{"statusCode":408,"responseTime":18584,"contentLength":9},"message":"PUT /api/saved_objects/index-pattern/063794b0-9a92-11ea-baa0-0519acdea2b0 408 18584ms - 9.0B"}
May 26 11:00:05 kibana[15614]: {"type":"response","@timestamp":"2020-05-26T08:59:47Z","tags":[],"pid":15614,"method":"put","statusCode":408,"req":{"url":"/api/saved_objects/index-pattern/063794b0-9a92-11ea-baa0-0519acdea2b0","method":"put","headers":{"host":"192.168.67.20:5601","connection":"keep-alive","content-length":"625315","kbn-version":"7.7.0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36","content-type":"application/json","accept":"*/*","origin":"http://192.168.67.20:5601","referer":"http://192.168.67.20:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"},"remoteAddress":"192.168.64.53","userAgent":"192.168.64.53","referer":"http://192.168.67.20:5601/app/kibana"},"res":{"statusCode":408,"responseTime":17844,"contentLength":9},"message":"PUT /api/saved_objects/index-pattern/063794b0-9a92-11ea-baa0-0519acdea2b0 408 17844ms - 9.0B"}
May 26 11:00:11 kibana[15614]: {"type":"response","@timestamp":"2020-05-26T09:00:11Z","tags":[],"pid":15614,"method":"post","statusCode":200,"req":{"url":"/api/index_management/indices/reload","method":"post","headers":{"host":"192.168.67.20:5601","connection":"keep-alive","content-length":"54","kbn-version":"7.7.0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36","content-type":"application/json","accept":"*/*","origin":"http://192.168.67.20:5601","referer":"http://192.168.67.20:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"},"remoteAddress":"192.168.64.53","userAgent":"192.168.64.53","referer":"http://192.168.67.20:5601/app/kibana"},"res":{"statusCode":200,"responseTime":50,"contentLength":9},"message":"POST /api/index_management/indices/reload 200 50ms - 9.0B"}
May 26 11:00:25 kibana[15614]: {"type":"response","@timestamp":"2020-05-26T09:00:06Z","tags":[],"pid":15614,"method":"put","statusCode":408,"req":{"url":"/api/saved_objects/index-pattern/063794b0-9a92-11ea-baa0-0519acdea2b0","method":"put","headers":{"host":"192.168.67.20:5601","connection":"keep-alive","content-length":"625315","kbn-version":"7.7.0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36","content-type":"application/json","accept":"*/*","origin":"http://192.168.67.20:5601","referer":"http://192.168.67.20:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"},"remoteAddress":"192.168.64.53","userAgent":"192.168.64.53","referer":"http://192.168.67.20:5601/app/kibana"},"res":{"statusCode":408,"responseTime":19637,"contentLength":9},"message":"PUT /api/saved_objects/index-pattern/063794b0-9a92-11ea-baa0-0519acdea2b0 408 19637ms - 9.0B"}
Avez-vous un idée d'où ça peut venir ?
Je vous remercie d'avance.