aws-samples / aws-samples/aws-waf-dashboard
Dashboard errors on httpRequest.clientIp after install
- Dominant language
- Java
- Stars
- 40
- Forks
- 38
- PR merge metrics
- No merged PRs in 30d
Description
The first index that is built has cleintIp as text. This throws the following error in the Dashboard:
`Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Fielddata is disabled on text fields by default. Set fielddata=true on [httpRequest.clientIp] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead."}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"awswaf-2020-07-23","node":"YRRPzsdTRNKcReVxFSbKwA","reason":`
Two things fix it.
- When a second index is built clientIp becomes a keyword. I think this is coming from aws-waf-dashboard/cloudformation-custom-resources/kibana-customizer-lambda/custom/template.json.
- Changing the three saved objects of Top10 IpAddresses, Filters and Unique IP count to have "field": "httpRequest.clientIp.keyword" in visiState instead of just "httpRequest.clientIp".
Contributor guide
Research direction
Inspect cloudformation-custom-resources/kibana-customizer-lambda/custom/template.json and the saved objects for Top10 IpAddresses, Filters, and Unique IP count. Compare the first index mapping with the later index, then verify that the dashboard uses the keyword field and no longer raises the reported fielddata error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, elasticsearch
- Domain
- cloud, observability
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100