Circuit Breaker Exception error is disabling rule

[roman-tasi]

This is the error:

ERROR elastalert Uncaught exception running rule Zimbra Login Success (Discord): TransportError(429, 'circuit_breaking_exception', '[parent] Data too large, data for [<http_request>] would be [512609692/488.8mb], which is larger than the limit of [510027366/486.3mb], real usage: [512609408/488.8mb], new bytes reserved: [284/284b], usages [request=0/0b, fielddata=104969/102.5kb, in_flight_requests=8638/8.4kb, model_inference=0/0b, eql_sequence=0/0b, accounting=18783966/17.9mb]')

Note the error is not just limited to this one rule, it also is effecting other rules.

It obviously seems memory-related, however my storage is only at 35%... Could it be heap-related, or something else? Basically what type of memory should I try to extend?

[jertel]

This is an Elasticsearch issue, likely related to the size of the documents or number of fields in your indices. Increasing heap may help but it's like going to punt the problem down the road. I suggest reading up on index structuring and tuning, reviewing the size of the content (amount of data per document) you are storing in your indices, and/or checking in with the Elasticsearch discussion forum for help.

[roman-tasi]

Thanks, I fixed this by allowing ES to access more heap space in it's jvm.options config file.