Repository navigation
Timeout error in HTTP app #428
Description
HTTP app version 1.4.0
When I'm trying to GET alerts from DFIR IRIS with http app or "custom action" in IRIS app i get an error/
IRIS endpoint: /alerts/filter
this endpoint by default return 10 alerts and total number of pages, and in this case everything works fine,
But when i'm adding query params like this per_page=100&creation_start_date=$exec.start_date&creation_end_date=$exec.end_date i get an error because of timeout (more than 10 alerts takes time to process by IRIS and return response)
shuffle_action_logs (sanitized):
2025-06-17 09:38:35,304 - HTTP - INFO - [INFO][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Action name: GET, Params: 9, Has Body: False
2025-06-17 09:38:35,318 - HTTP - INFO - [INFO][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Running function 'GET' with timeout 30
2025-06-17 09:38:35,323 - HTTP - INFO - ['Accept: application/json', 'Authorization: Bearer correct_IRIS_API_token']
2025-06-17 09:38:40,365 - HTTP - INFO - [ERROR] Something is wrong with the input for this function. Are lists and JSON data handled parsed properly (1)? err: HTTPSConnectionPool(host='myirisdomain.org', port=443): Read timed out. (read timeout=5)
2025-06-17 09:38:40,365 - HTTP - INFO - [DEBUG][a1269c43-3993-45eb-bba7-24b04cdf2fcd] Sending result to https://myshuffledomain.org/api/v1/streams
My idea to fetch all alerts for some period of time, like per_page=10000 and process them all in my workflow, so i wanna set timeout like 10-30mins for this action
if i read code of http app properly timeout=5 is hardcoded, my suggestion to add possibility to change this value
Activity
Kagetana commentedon Jun 17, 2025
Correction:
I guess I'm blind, it's already there
But it doesn't help me with value like 600
{"success":false,"reason":"POST error: Failed connecting to https://shuffle1.hosterby.com/api/v1/streams over 10 retries to the backend"}Kagetana commentedon Jun 17, 2025
Execution with fetching almost 2k alerts in console from shuffle host handled approximately in 20 sec
Curl/http/IRIS apps got stuck, for now have no idea how to bypass this problem
frikky commentedon Jun 17, 2025
This sounds like a backend problem on the Shuffle database side, which usually stems from too large amounts of data being returned.
Could you check the shuffle-backend container at the same time as this app error showed up?
docker logs shuffle-backendKagetana commentedon Jun 18, 2025
this is backend logs:
So Shuffle can't process large amount of data? Or problem not that?