The message tells that on port 9200, the HTTP message could not be understood. Do you send non-HTTP traffic to port 9200?
Jörg On Wed, Sep 10, 2014 at 1:34 PM, Andrew Lakes <[email protected]> wrote: > Hey Guys, > > today we encoutered a problem while requesting some data from our ES db > from an other server in our network. > > All that the other server does is executing the following request: > > curl -XGET > 'https://elasticsearch-server:443/logstash-2014.09.10,logstash-2014.09.09/_search?pretty' > -d '{ > "query": { > "filtered": { > "query": { > "bool": { > "should": [ > { > "query_string": { > "query": "field:*" > } > } > ] > } > }, > "filter": { > "bool": { > "must": [ > { > "range": { > "@timestamp": { > "from": 1410261816133, > "to": 1410348216133 > } > } > }, > { > "fquery": { > "query": { > "query_string": { > "query": "logsource:(\"servername\")" > } > }, > "_cache": true > } > } > ] > } > } > } > }, > "highlight": { > "fields": {}, > "fragment_size": 2147483647, > "pre_tags": [ > "@start-highlight@" > ], > "post_tags": [ > "@end-highlight@" > ] > }, > "size": 100, > "sort": [ > { > "@timestamp": { > "order": "desc", > "ignore_unmapped": true > } > }, > { > "@timestamp": { > "order": "desc", > "ignore_unmapped": true > } > } > ] > }' > > > which simply count how much events 1 server over 24 hours got. > > > But if this request lead to some abnormal behavior of elasticsearch, we much > of the following error messages in our es-log: > > > [2014-09-10 13:12:32,938][DEBUG][http.netty ] [NodeName] Caught > exception while handling client http traffic, closing connection [id: > 0x5fd6fd9f, /<IP of the remote Server>:40784 :> /<IP of the ES server:9200] > java.nio.channels.ClosedChannelException > at > org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.cleanUpWriteBuffer(AbstractNioWorker.java:433) > at > org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.writeFromUserCode(AbstractNioWorker.java:128) > at > org.elasticsearch.common.netty.channel.socket.nio.NioServerSocketPipelineSink.handleAcceptedSocket(NioServerSocketPipelineSink.java:99) > at > org.elasticsearch.common.netty.channel.socket.nio.NioServerSocketPipelineSink.eventSunk(NioServerSocketPipelineSink.java:36) > at > org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:779) > at > org.elasticsearch.common.netty.channel.Channels.write(Channels.java:725) > at > org.elasticsearch.common.netty.handler.codec.oneone.OneToOneEncoder.doEncode(OneToOneEncoder.java:71) > at > org.elasticsearch.common.netty.handler.codec.oneone.OneToOneEncoder.handleDownstream(OneToOneEncoder.java:59) > at > org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) > at > org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:582) > at > org.elasticsearch.common.netty.channel.Channels.write(Channels.java:704) > at > org.elasticsearch.common.netty.channel.Channels.write(Channels.java:671) > at > org.elasticsearch.common.netty.channel.AbstractChannel.write(AbstractChannel.java:248) > at > org.elasticsearch.http.netty.NettyHttpChannel.sendResponse(NettyHttpChannel.java:173) > at > org.elasticsearch.rest.action.support.RestResponseListener.processResponse(RestResponseListener.java:43) > at > org.elasticsearch.rest.action.support.RestActionListener.onResponse(RestActionListener.java:49) > at > org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction$AsyncAction.innerFinishHim(TransportSearchQueryThenFetchAction.java:157) > at > org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction$AsyncAction.finishHim(TransportSearchQueryThenFetchAction.java:139) > at > org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction$AsyncAction.moveToSecondPhase(TransportSearchQueryThenFetchAction.java:90) > at > org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.innerMoveToSecondPhase(TransportSearchTypeAction.java:404) > at > org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.onFirstPhaseResult(TransportSearchTypeAction.java:198) > at > org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction$1.onResult(TransportSearchTypeAction.java:174) > at > org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction$1.onResult(TransportSearchTypeAction.java:171) > at > org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:526) > at > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) > at > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) > at java.lang.Thread.run(Thread.java:745 > > > As soon as we active this request from the remote server we get a whole lot > of this error messages and everything in elasticsearch slows down pretty hard > (Even Kibana request get stuck in the queue). > > > Anybody got an idea why this is happening? > > > Any feedback is appreciated. > > > Thanks > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/elasticsearch/85627251-b4be-4031-870a-2bd621d0973c%40googlegroups.com > <https://groups.google.com/d/msgid/elasticsearch/85627251-b4be-4031-870a-2bd621d0973c%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAKdsXoGLQUsiTq6WktoLDUTQ0_WcU1ys_uBEy21g6grmkAcPhg%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
