Setting for HTTP Connection timeout

[Neuro-HSOC]

Hi all,

just a quick question. Is there any way to configure the http timeout for urllib used by elastalert?

I have one cardinality rule doing a quite heavy aggregation on Kerberos ticket request logs from a huge AD (50k+ users), which occasionally runs into timeouts like this:

Error running query: ConnectionTimeout caused by - ReadTimeout(HTTPSConnectionPool(host='myelasticluster', port=443): Read timed out. (read timeout=20))

Due to the volume processed it is totally expected to sometimes take more than 20 seconds and it would be great to simply increase the timeout a bit. :-)

Best regards,
Sebastian

[ferozsalam]

See es_conn_timeout here

[Neuro-HSOC]

Oh, totally missed that one.

I had a look at Common Configuration Options in the rules section but apparently missed the global settings. Good to know and thanks for pointing out. 👍