# Socket hang up while taking CSV report **URL:** \ **Category:** Kibana\ **Created:** [February 22, 2018, 11:44am UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036 "2018-02-22T11:44:24Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![hadi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hadi/32/27893_2.png) [@hadi](https://discuss.elastic.co/u/hadi)\ **Post date:** [February 22, 2018, 11:44am UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/1 "2018-02-22T11:44:24Z")
Hi. When I want to make an not so huge CSV report, less than 300 thousands hits. But I get the **socket hang up** error in Kibana; which eventually leads to the reporting fails. recent logs in Kibana are as follows! ``` sudo tailf /var/log/kibana/kibana.log {"type":"log","@timestamp":"2018-02-22T10:06:27Z","tags":["error","elasticsearch","admin"],"pid":1748,"message":"Request error, retrying\nPOST http://10.50.40.185:9200/.kibana/_search?size=0&from=0 => socket hang up"} {"type":"log","@timestamp":"2018-02-22T10:06:27Z","tags":["error","elasticsearch","admin"],"pid":1748,"message":"Request error, retrying\nPOST http://10.50.40.185:9200/.kibana/_search?size=0&from=0 => socket hang up"} {"type":"log","@timestamp":"2018-02-22T10:06:28Z","tags":["error","elasticsearch","admin"],"pid":1748,"message":"Request error, retrying\nPOST http://10.50.40.185:9200/.reporting-*/esqueue/_search?version=true => socket hang up"} {"type":"log","@timestamp":"2018-02-22T10:06:28Z","tags":["error","elasticsearch","admin"],"pid":1748,"message":"Request error, retrying\nPOST http://10.50.40.185:9200/.reporting-*/esqueue/_search?version=true => socket hang up"} ``` And here is my kibana config file: ``` cat /etc/kibana/kibana.yml server.host: 10.50.30.150 elasticsearch.url: http://10.50.30.150:9200 elasticsearch.requestTimeout: 3600000 pid.file: "/var/run/kibana/kibana.pid" logging.dest: /var/log/kibana/kibana.log logging.quiet: true xpack.ml.enabled: false xpack.graph.enabled: false xpack.apm.ui.enabled: false xpack.watcher.enabled: false xpack.security.enabled: false xpack.reporting.queue.timeout: 3600000 xpack.reporting.encryptionKey: "4322378651" xpack.reporting.csv.maxSizeBytes: 104857600 ``` BTW, AWS load balancer Idle-timeout is sets to 3600 seconds! Any help will be appreciated ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [February 22, 2018, 4:12pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/2 "2018-02-22T16:12:19Z")
How far do you have to back the number of hits to to get it to work? For example, if you set your timespan to some shorter time so that you get 200k hits does the csv work, and how long does it take? Also, is there anything in your Elasticsearch log for it? Errors, etc? ---
**Author:** ![hadi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hadi/32/27893_2.png) [@hadi](https://discuss.elastic.co/u/hadi)\ **Post date:** [February 23, 2018, 11:38am UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/3 "2018-02-23T11:38:20Z")
Thank you for your reply. There is no Error/Warn log none of the servers (master, ingest, data)! For 200k it also fails. For 50k works! ---
**Author:** ![hadi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hadi/32/27893_2.png) [@hadi](https://discuss.elastic.co/u/hadi)\ **Post date:** [February 23, 2018, 12:04pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/4 "2018-02-23T12:04:11Z")
It took almost eight minutes. ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [February 23, 2018, 2:52pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/5 "2018-02-23T14:52:07Z")
Have you changed the max size for the CSV reporting? The reason I ask is that if I have a saved search with only a couple of columns of data selected I can still only get about 150k docs before I hit the max size of 10MB. And for me that takes less than 1 minute. ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [February 23, 2018, 2:52pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/6 "2018-02-23T14:52:45Z")
For mine, Reporting page for the report shows `completed - max size reached` ---
**Author:** ![hadi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hadi/32/27893_2.png) [@hadi](https://discuss.elastic.co/u/hadi)\ **Post date:** [February 23, 2018, 3:15pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/7 "2018-02-23T15:15:57Z")
Thanks for your reply LeeDr. Yeah, I already set that to 100MB! Problem is with socket hangup, which should be related to a misconfiguration on time or ...? Not sure exactly! ---
**Author:** ![hadi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hadi/32/27893_2.png) [@hadi](https://discuss.elastic.co/u/hadi)\ **Post date:** [February 23, 2018, 3:18pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/8 "2018-02-23T15:18:28Z")
Please let me know if you have any suggestions or I have to upload some config files? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [February 23, 2018, 3:27pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/9 "2018-02-23T15:27:35Z")
@hari the way that Reporting works currently, is the export (in this situation the CSV) is indexed into Elasticsearch as a single document so the user can download it later. This operation to store the export in Elasticsearch is a single HTTP request. Elasticsearch enforces a maximum HTTP request size of 100 mB by default, and there is additional overhead of the http request itself that is cause us to exceed this threshold. You'll want to lower `xpack.reporting.csv.maxSizeBytes` to something like 99mB to no longer hit this limit, or adjust Elasticsearch's `http.max_content_length` [documented here](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/modules-http.html) to something higher. With all this being said, storing really large documents (even 100mB) in Elasticsearch is not advised, it hasn't been tested and it's not supported, so you are doing so at your own risk. We intend to address this limitation in another method be allowing the exported CSV to no longer be stored as a single document, but to be "chunked" into multiple and combined when streaming them to the end-user. ---
**Author:** ![hadi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hadi/32/27893_2.png) [@hadi](https://discuss.elastic.co/u/hadi)\ **Post date:** [February 26, 2018, 2:40pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/10 "2018-02-26T14:40:25Z")
Thank you @Brandon_Kobel. After applying this limitation it works now. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 26, 2018, 2:41pm UTC](https://discuss.elastic.co/t/socket-hang-up-while-taking-csv-report/121036/11 "2018-03-26T14:41:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.