Socket hang up while taking CSV report - X-pack

Elastic Stack Elasticsearch
1

Hi.

When I want to make an not so huge CSV report, less than 300 thousands hits. But I get the socket hang up error in Kibana; which eventually leads to the reporting fails.

recent logs in Kibana are as follows!

sudo tailf /var/log/kibana/kibana.log
{"type":"log","@timestamp":"2018-02-22T10:06:27Z","tags":["error","elasticsearch","admin"],"pid":1748,"message":"Request error, retrying\nPOST http://10.50.40.185:9200/.kibana/_search?size=0&from=0 => socket hang up"}
{"type":"log","@timestamp":"2018-02-22T10:06:27Z","tags":["error","elasticsearch","admin"],"pid":1748,"message":"Request error, retrying\nPOST http://10.50.40.185:9200/.kibana/_search?size=0&from=0 => socket hang up"}
{"type":"log","@timestamp":"2018-02-22T10:06:28Z","tags":["error","elasticsearch","admin"],"pid":1748,"message":"Request error, retrying\nPOST http://10.50.40.185:9200/.reporting-*/esqueue/_search?version=true => socket hang up"}
{"type":"log","@timestamp":"2018-02-22T10:06:28Z","tags":["error","elasticsearch","admin"],"pid":1748,"message":"Request error, retrying\nPOST http://10.50.40.185:9200/.reporting-*/esqueue/_search?version=true => socket hang up"}

And here is my kibana config file:

cat /etc/kibana/kibana.yml 
server.host: 10.50.30.150
elasticsearch.url: http://10.50.30.150:9200
elasticsearch.requestTimeout: 3600000
pid.file: "/var/run/kibana/kibana.pid"
logging.dest: /var/log/kibana/kibana.log
logging.quiet: true
xpack.ml.enabled: false
xpack.graph.enabled: false
xpack.apm.ui.enabled: false
xpack.watcher.enabled: false
xpack.security.enabled: false
xpack.reporting.queue.timeout: 3600000
xpack.reporting.encryptionKey: "4322378651"

BTW, AWS load balancer Idle-timeout is sets to 3600 seconds!

Any help will be appreciated

2

Can you try a smaller CSV export by changing the timespan smaller so that it includes less documents?

If you do that, how large can you go before it fails? And how long does that take, and how big is the resulting CSV file?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.