NVISOsecurity / ee-outliers

Open-source framework to detect outliers in Elasticsearch events
https://blog.nviso.eu
GNU General Public License v3.0
204 stars 34 forks source link

Introduce a sleep before reconnecting in case connection got lost, to avoid spammy error logs #335

Closed daanraman closed 4 years ago

detobel36 commented 5 years ago

Currently it is ElasticSearch library that try again to connect to database (due to parameter retry_on_timeout set on True).
So to add timer between each connection test, two solution are possible:

There is maybe a possibility to fetch log and only display a small message (and not all the trace)

EDIT: Linked to this: https://github.com/NVISO-BE/ee-outliers/blob/master/app/helpers/es.py#L52 EDIT2: Interesting stuff about that: https://github.com/elastic/elasticsearch-py/issues/666

daanraman commented 4 years ago

Elasticsearch reconnections are now wrapped in a 1 minute sleep cycle to avoid this issue.

Example:


    # Initialize Elasticsearch connection
    while not es.init_connection():
        time.sleep(60)
daanraman commented 4 years ago

Tested this in a local deployment where the connection fails - sleep is respected.