From 4a7d588a4249230d41f4e99618032837d4215db8 Mon Sep 17 00:00:00 2001
From: "opensearch-trigger-bot[bot]"
 <98922864+opensearch-trigger-bot[bot]@users.noreply.github.com>
Date: Mon, 28 Oct 2024 12:12:40 -0700
Subject: [PATCH] [Bug] Add exists check for IOCs index. (#1392) (#1396)

* Added check to prevent resource_already_exists_exception when indexing more than 10k iocs.



* Changed log message.



---------


(cherry picked from commit 4432b36a2f97e312f1ef3db2e900e6f9071b3fac)

Signed-off-by: AWSHurneyt <hurneyt@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 .../securityanalytics/services/STIX2IOCFeedStore.java      | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCFeedStore.java b/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCFeedStore.java
index 0eddc8f88..9602fbfce 100644
--- a/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCFeedStore.java
+++ b/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCFeedStore.java
@@ -9,6 +9,7 @@
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.opensearch.OpenSearchException;
+import org.opensearch.ResourceAlreadyExistsException;
 import org.opensearch.action.DocWriteRequest;
 import org.opensearch.action.StepListener;
 import org.opensearch.action.admin.indices.create.CreateIndexRequest;
@@ -34,6 +35,7 @@
 import org.opensearch.securityanalytics.threatIntel.common.StashedThreadContext;
 import org.opensearch.securityanalytics.threatIntel.model.DefaultIocStoreConfig;
 import org.opensearch.securityanalytics.threatIntel.model.SATIFSourceConfig;
+import org.opensearch.transport.RemoteTransportException;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -241,6 +243,11 @@ private void initFeedIndex(String feedIndexName, ActionListener<CreateIndexRespo
                         listener.onResponse(r);
                     },
                     e -> {
+                        if (e instanceof ResourceAlreadyExistsException || (e instanceof RemoteTransportException && e.getCause() instanceof ResourceAlreadyExistsException)) {
+                            log.debug("index {} already exist", feedIndexName);
+                            listener.onResponse(null);
+                            return;
+                        }
                         log.error("Failed to create system index {}", feedIndexName);
                         listener.onFailure(e);
                     }