Configurable search timeouts

[stoerr]

I'd like to suggest that you add a (configurable) timeout parameter
http://www.elasticsearch.org/guide/reference/api/search/request-body/
to the search calls.

Rationale: if you make a unlucky search query on a large dataset you can practically block elasticsearch for a long time. If you add a timeout of, say, 10 seconds, that will limit the ability of the user to send elasticsearch accidentially trashing over terabytes of log data.

[sakalajuraj]

+1 for this

[damienclaveau]

+1

[deviantony]

+1

[ghost]

+1

[CullyB]

+1

[nilsbrenkman]

+1

[cwneal]

+1

[cdeck]

👍

[spalger]

👍

[rashidkpc]

The current timeout is 60s. Kibana will give up, but in reality, the query will keep executing. Afaik Elasticsearch doesn't really abort it. Anything that is taking 60s is probably deep into nasty garbage collection anyway and there isn't much we can do about it. That said, the 60s should definitely be configurable.

[stoerr]

@rashidkpc A timeout only at kibana side is IMHO worse than having no timeout at all - that way the user might just resubmit the request and trash the system without even knowing.

A request can also take very long because it searches loads of data - if you have a terabyte on disk you can probably take much longer than a minute if you query the whole range.

And you can easily do something. For instance here is a timeout parameter:
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-uri-request.html
Just add that, and you are done. Pretty please. :-)

[rashidkpc]

@stoerr The elasticsearch timeout parameter has the same issue as the kibana one. If your search is taking that long something bad has already happened and Elasticsearch as no way of stopping it. So even if elasticsearch times out, the thing that was taking a long time, usually garbage collection, is still happening.

[stoerr]

@rashidkpc At least in our case the problem certainly was not that anything bad happened that couldn't be interrupted (a garbage collection doesn't take one whole minute on a few gigabytes), but just that the request collected way too much data, loading way too much stuff from disk. And that's certainly something elasticsearch would be able to stop - if you just tell it the timeout. So, please do. :-)

It's probably quite easy, isn't it? IMHO there is no need for configurability - the 60s would be just fine.

[german23]

+1 for configurable timeout

As already pointed out if you search over a few terrabytes of data, the search will probably take over 60s, that said atm its a nasty problem that kibana just get "stuck" after the 60s even it loaded only half of the data - a configurable timeout would eliminate that problem.

That beeing said - the are the actual 60s hardcoded somewhere or can they be changed by editing some files in the kibana directories?