Circuit breaking exception Data too large

[Renan Rivera]

Hello Guys,

I'm having trouble with my wazuh version 4.3.5:

Below is the error message:

{"error":{"root_cause":[{"type":"circuit_breaking_exception","reason":"[parent] Data too large, data for [<http_request>] would be [1038651472/990.5mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1038651472/990.5mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=52348/51.1kb, in_flight_requests=0/0b, accounting=85666092/81.6mb]","bytes_wanted":1038651472,"bytes_limit":1020054732,"durability":"PERMANENT"}],"type":"circuit_breaking_exception","reason":"[parent] Data too large, data for [<http_request>] would be [1038651472/990.5mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1038651472/990.5mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=52348/51.1kb, in_flight_requests=0/0b, accounting=85666092/81.6mb]","bytes_wanted":1038651472,"bytes_limit":1020054732,"durability":"PERMANENT"},"status":429}

I already upgrade the server memory and restarted the services still the error still prompting.

Please, appreciate your help.

Thank you,

Renan

[Mateo James]

Hi Renan, thanks for using Wazuh!

It seems like you are hitting a circuit breaking exception due to the data size limit being exceeded. You can try increasing the limit by modifying the OpenSearch configuration. Did you install Wazuh using standard installation? And could you specify which Wazuh component/s are you using, and what are the main specs of the server?

Kind regards,

Mateo

[Renan Rivera]

Hello Mateo,

Thank you for replying to my email.

It seems like you are hitting a circuit breaking exception due to the data size limit being exceeded. You can try increasing the limit by modifying the OpenSearch configuration. 

Sorry, I tried but I'm not quite sure, Can you guide me how to modify the opensearch configuration?

Did you install Wazuh using standard installation?

Yes, using step by step installation. However I upgraded from elasticsearch to opensearch. I am currently at 4.3.5

 And could you specify which Wazuh component/s are you using, 

I am using wazuh-dashboard, wazuh indexer and wazuh dashboard.

and what are the main specs of the server?

I have 2 servers:

Wazuh-Dashboard, Indexer

8gb and 3 CPU using HyperV

Wazuh-Manager

4gb and 2 CPU using HyperV

Appreciate your help.

Thank you,

Renan

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh mailing list" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/prIHE47mxX8/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/4ba7728f-c5d7-450c-9bdf-c67055d4dc1en%40googlegroups.com.

[Mateo James]

Hi Renan,

You can change the total heap space via /etc/wazuh-indexer/jvm.options file. Here is an example of an increase from ~ 2GB to 4GB:
# -Xms1931m
# -Xmx1931m
-Xms4g
-Xmx4g
You can check if that works. Also there is a nice guide about how to tune your environment to avoid these exceptions here.

Please let us know if this is helpful!

Kinds regards,

Mateo

[Cris Mead (FedaykinWolf)]

FYI this fixed the same issue for me, Thank you!