aws-samples / aws-samples/aws-waf-dashboard

Dashboard errors on httpRequest.clientIp after install

Open
#2 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
40
Forks
38
PR merge metrics
No merged PRs in 30d

Description

The first index that is built has cleintIp as text. This throws the following error in the Dashboard:

`Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [httpRequest.clientIp] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"awswaf-2020-07-23","node":"YRRPzsdTRNKcReVxFSbKwA","reason":`

Two things fix it.

- When a second index is built clientIp becomes a keyword. I think this is coming from aws-waf-dashboard/cloudformation-custom-resources/kibana-customizer-lambda/custom/template.json.
- Changing the three saved objects of Top10 IpAddresses, Filters and Unique IP count to have "field": "httpRequest.clientIp.keyword" in visiState instead of just "httpRequest.clientIp".

Contributor guide

Open the contributing guide

Research direction

Inspect cloudformation-custom-resources/kibana-customizer-lambda/custom/template.json and the saved objects for Top10 IpAddresses, Filters, and Unique IP count. Compare the first index mapping with the later index, then verify that the dashboard uses the keyword field and no longer raises the reported fielddata error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, elasticsearch
Domain
cloud, observability
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.