What does Courier Fetch x of xxx shards failed mean?

[namobud...@gmail.com]

Hello Group,

I'm wondering what the following error indicates and means:

What does Courier Fetch x of xxx shards failed mean?

Thanks so much!

[Santiago Bassett]

Elasticsearch search queue size? https://github.com/elastic/kibana/issues/3221

--

---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Pedro S]

Hi,

When are you getting this error exactly? when opening a dashboard? at "Discover" tab?

It is a very generic error, there are different approaches to solve this:
- What specs have your machine?

- Are you creating a daily index? how many index have your cluster now?

- How many shards per index?

- Are you using a lot of wildcards (*)?

The point is Elasticsearch can't handle the request on time, one solution is edit your elasticsearch.yml and change the following parameters:
threadpool.search.type: fixed

threadpool.search.size: 20

threadpool.search.queue_size: 10000

BE AWARE! Increasing queue_size will create so many threads on your machine, the best solution is try to find what is causing the error and not just increase queue_size, or if you prefer, use a browser debuger and inspect HTTP error responses from Elastic, you will see something like: "EsRejectedExecutionException[rejected execution (queue capacity 1000) on org.elasticsearch.search.action...", try to adjust queue_size as low as possible.

[Shri Harsha]

I am getting this error when opening dashbord.

- My Specs are 8 vCPU's, 32GiB RAM

- I am creating monthly indexes. Currently I have 257 indexes.

-Each Index has 5 primary shards.

- As per Wildcards I am not sure what you are talking about?