Unable to load reports from the vIDM admin UI or unable to delete shards

Products

• VMware Aria Suite

Issue/Introduction

• When attempting to load reports from the vIDM admin UI the following error is thrown

• When deleting unassigned shard as per kb see the below error in the logs
• The analytics-service.log under /opt/vmware/horizon/workspace/logs shows the following entries
  • {"errors":[{"code":"error.queryFailed","message":"Unable to execute query","parameters":{"reason":"{\"root_cause\":[{\"type\":\"circuit_breaking_exception\",\"reason\":\"[parent] Data too large, data for [<http_request>] would be [1018309538/971.1mb], which is larger than the limit of [986061209/940.3mb], real usage: [1018308392/971.1mb], new bytes reserved: [1146/1.1kb], usages [request=0/0b, fielddata=18070/17.6kb, in_flight_requests=1146/1.1kb, accounting=2117792/2mb]\",\"bytes_wanted\":1018309538,\"bytes_limit\":986061209,\"durability\":\"PERMANENT\"}],\"type\":\"circuit_breaking_exception\",\"reason\":\"[parent] Data too large, data for [<http_request>] would be [1018309538/971.1mb], which is larger than the limit of [986061209/940.3mb], real usage: [1018308392/971.1mb], new bytes reserved: [1146/1.1kb], usages [request=0/0b, fielddata=18070/17.6kb, in_flight_requests=1146/1.1kb, accounting=2117792/2mb]\",\"bytes_wanted\":1018309538,\"bytes_limit\":986061209,\"durability\":\"PERMANENT\"}"}}]}

Cause

This issue is caused due to opensearch not having a large enough http content length configured

Resolution

To resolve the issue perform the following steps below

1. Take a backup/snapshot of the vIDM appliance(s)

2. Edit the opensearch.yml configuration file under /opt/vmware/opensearch/config on each vIDM appliance

3. Add the following parameter to the end of the file

http.max_content_length: 1000mb

4. Restart opensearch service for the new settings to take effect

service opensearch restart