-
Problem report
-
Resolution: Fixed
-
Trivial
-
None
-
4.0.19
-
None
"as recommended by the elasticsearch documentation, we close the scroll search through a DELETE request"
While sending a DELETE to close the _scroll request is proper behavior, the linked code sends the DELETE request with a Content-Length: -1. This is against RFC https://tools.ietf.org/html/rfc7230#section-3.3.2
Any Content-Length field value greater than or equal to zero is
valid. Since there is no predefined limit to the length of a
payload, a recipient MUST anticipate potentially large decimal
numerals and prevent parsing errors due to integer conversion
overflows
Elasticsearch does not care about Content-Length: -1, but web proxies such as NGINX will reject the request with 400, which is undesired.
Previously spoke with Alexander Sergunin. We are sending traffic through NGINX to mitigate another issue, which I will link on this ticket.
Steps to reproduce:
- Configure Zabbix server to use Elasticsearch as a history backend
- Configure an NGINX proxy to sit between elasticsearch and the zabbix server
- Add some items and triggers to zabbix
- Watch the Zabbix logs and Nginx logs for 400
Result:
10.1.1.1 - - [21/Apr/2020:19:00:14 +0000] "DELETE /_search/scroll/DnF1ZXJ5VGhlbkZldGNoCgAAAAEbxSetFmtVM1Q3WGI2UXFLS3ZBUzZGRmdzeEEAAAABG8UntRZrVTNUN1hiNlFxS0t2QVM2RkZnc3hBAAAAARvFJ7IWa1UzVDdYYjZRcUtLdkFTNkZGZ3N4QQAAAAEbxSe2FmtVM1Q3WGI2UXFLS3ZBUzZGRmdzeEEAAAABG8UnrhZrVTNUN1hiNlFxS0t2QVM2RkZnc3hBAAAAARvFJ7QWa1UzVDdYYjZRcUtLdkFTNkZGZ3N4QQAAAAEbxSezFmtVM1Q3WGI2UXFLS3ZBUzZGRmdzeEEAAAABG8UnrxZrVTNUN1hiNlFxS0t2QVM2RkZnc3hBAAAAARvFJ7AWa1UzVDdYYjZRcUtLdkFTNkZGZ3N4QQAAAAEbxSexFmtVM1Q3WGI2UXFLS3ZBUzZGRmdzeEE= HTTP/1.1" 400 173 "" ""
Expected:
Omit the Content-Length: -1 header.
I can be available via video conference to help demonstrate the issue if needed.