TheHive-Project / TheHive-Project/Cortex
ElasticError mapper_parsing_exception
Open
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.6k
- Forks
- 264
- PR merge metrics
- No merged PRs in 30d
Description
Request Type
Bug
Work Environment
| Question | Answer |
|---|---|
| OS version (server) | RedHat |
| OS version (client) | Fedora |
| Cortex version | cortex:3.1.0-0.1RC1 |
| Package Type | Docker |
| Browser type & version | Chrome |
| Elasticsearch version | 7 |
Problem Description
Cortex errors when submitting a job in UI.

Log:
[[37minfo[0m] o.t.c.s.JobSrv - Looking for similar job in the last 1440 minutes (worker=9c0a164f5e08042c9feed74e2021d72d, dataType=ad_user, data=Left(REDACTED), tlp=2, parameters={})
[[31merror[0m] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/cortex3_4/_doc?refresh=wait_for
ByteArrayEntity([B@4ab241c8,Some(application/json))
=> ElasticError(mapper_parsing_exception,failed to parse,None,None,None,List(ElasticError(mapper_parsing_exception,failed to parse,None,None,None,null,None,None,None,null)),Some(CausedBy(illegal_argument_exception,unknown join name [job] for field [relations],Map())),None,None,null)
[[37minfo[0m] o.t.c.s.ErrorHandler - POST /api/analyzer/9c0a164f5e08042c9feed74e2021d72d/run returned 500
org.elastic4play.InternalError: Unknown error: ElasticError(mapper_parsing_exception,failed to parse,None,None,None,List(ElasticError(mapper_parsing_exception,failed to parse,None,None,None,null,None,None,None,null)),Some(CausedBy(illegal_argument_exception,unknown join name [job] for field [relations],Map())),None,None,null)
at org.elastic4play.database.DBConfiguration.$anonfun$execute$2(DBConfiguration.scala:150)
at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:307)
at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:56)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:93)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:93)
at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:48)
[[37minfo[0m] o.t.c.s.JobSrv - Looking for similar job in the last 1440 minutes (worker=9c0a164f5e08042c9feed74e2021d72d, dataType=ad_user, data=Left(REDACTED), tlp=2, parameters={})
[[31merror[0m] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/cortex3_4/_doc?refresh=wait_for
ByteArrayEntity([B@5ab6ba72,Some(application/json))
=> ElasticError(mapper_parsing_exception,failed to parse,None,None,None,List(ElasticError(mapper_parsing_exception,failed to parse,None,None,None,null,None,None,None,null)),Some(CausedBy(illegal_argument_exception,unknown join name [job] for field [relations],Map())),None,None,null)
[[37minfo[0m] o.t.c.s.ErrorHandler - POST /api/analyzer/9c0a164f5e08042c9feed74e2021d72d/run returned 500
org.elastic4play.InternalError: Unknown error: ElasticError(mapper_parsing_exception,failed to parse,None,None,None,List(ElasticError(mapper_parsing_exception,failed to parse,None,None,None,null,None,None,None,null)),Some(CausedBy(illegal_argument_exception,unknown join name [job] for field [relations],Map())),None,None,null)
at org.elastic4play.database.DBConfiguration.$anonfun$execute$2(DBConfiguration.scala:150)
at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:307)
at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:56)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:93)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:93)
at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:48)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the failed UI job submission and the Elasticsearch 7 error showing an unknown join name [job] for field [relations]. Inspect DBConfiguration.scala:150 and the request or mapping involved in POST /cortex3_4/_doc?refresh=wait_for; done means the submission succeeds without mapper_parsing_exception or a 500 response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch, scala
- Domain
- backend, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100