TheHive-Project / TheHive-Project/Cortex

ElasticError mapper_parsing_exception

Open
#291 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Scala
Stars
1.6k
Forks
264
PR merge metrics
No merged PRs in 30d

Description

Request Type

Bug

Work Environment
Question Answer
OS version (server) RedHat
OS version (client) Fedora
Cortex version cortex:3.1.0-0.1RC1
Package Type Docker
Browser type & version Chrome
Elasticsearch version 7
Problem Description

Cortex errors when submitting a job in UI.
image
Log:

[info] o.t.c.s.JobSrv - Looking for similar job in the last 1440 minutes (worker=9c0a164f5e08042c9feed74e2021d72d, dataType=ad_user, data=Left(REDACTED), tlp=2, parameters={})
[error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/cortex3_4/_doc?refresh=wait_for
ByteArrayEntity([B@4ab241c8,Some(application/json))
 => ElasticError(mapper_parsing_exception,failed to parse,None,None,None,List(ElasticError(mapper_parsing_exception,failed to parse,None,None,None,null,None,None,None,null)),Some(CausedBy(illegal_argument_exception,unknown join name [job] for field [relations],Map())),None,None,null)
[info] o.t.c.s.ErrorHandler - POST /api/analyzer/9c0a164f5e08042c9feed74e2021d72d/run returned 500
org.elastic4play.InternalError: Unknown error: ElasticError(mapper_parsing_exception,failed to parse,None,None,None,List(ElasticError(mapper_parsing_exception,failed to parse,None,None,None,null,None,None,None,null)),Some(CausedBy(illegal_argument_exception,unknown join name [job] for field [relations],Map())),None,None,null)
	at org.elastic4play.database.DBConfiguration.$anonfun$execute$2(DBConfiguration.scala:150)
	at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:307)
	at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:56)
	at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:93)
	at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
	at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
	at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:93)
	at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:48)
[info] o.t.c.s.JobSrv - Looking for similar job in the last 1440 minutes (worker=9c0a164f5e08042c9feed74e2021d72d, dataType=ad_user, data=Left(REDACTED), tlp=2, parameters={})
[error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/cortex3_4/_doc?refresh=wait_for
ByteArrayEntity([B@5ab6ba72,Some(application/json))
 => ElasticError(mapper_parsing_exception,failed to parse,None,None,None,List(ElasticError(mapper_parsing_exception,failed to parse,None,None,None,null,None,None,None,null)),Some(CausedBy(illegal_argument_exception,unknown join name [job] for field [relations],Map())),None,None,null)
[info] o.t.c.s.ErrorHandler - POST /api/analyzer/9c0a164f5e08042c9feed74e2021d72d/run returned 500
org.elastic4play.InternalError: Unknown error: ElasticError(mapper_parsing_exception,failed to parse,None,None,None,List(ElasticError(mapper_parsing_exception,failed to parse,None,None,None,null,None,None,None,null)),Some(CausedBy(illegal_argument_exception,unknown join name [job] for field [relations],Map())),None,None,null)
	at org.elastic4play.database.DBConfiguration.$anonfun$execute$2(DBConfiguration.scala:150)
	at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:307)
	at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:56)
	at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:93)
	at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
	at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
	at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:93)
	at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:48)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the failed UI job submission and the Elasticsearch 7 error showing an unknown join name [job] for field [relations]. Inspect DBConfiguration.scala:150 and the request or mapping involved in POST /cortex3_4/_doc?refresh=wait_for; done means the submission succeeds without mapper_parsing_exception or a 500 response.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch, scala
Domain
backend, database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.