Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] 2.11 Creating custom log type fails #700

Closed
sandervandegeijn opened this issue Oct 18, 2023 · 14 comments
Closed

[BUG] 2.11 Creating custom log type fails #700

sandervandegeijn opened this issue Oct 18, 2023 · 14 comments
Labels
bug Something isn't working

Comments

@sandervandegeijn
Copy link

What is the bug?

See video:
https://github.com/opensearch-project/security-dashboards-plugin/assets/2643715/79f44dba-f742-46aa-9741-28347f09843b

What is the expected behavior?
A clear and concise description of what you expected to happen.

What is your host/environment?
2.11 default docker container

Do you have any screenshots?
^^

Do you have any additional context?
N/A

@sandervandegeijn sandervandegeijn added bug Something isn't working untriaged labels Oct 18, 2023
@sandervandegeijn
Copy link
Author

Should have created this in: https://github.com/opensearch-project/security-analytics-dashboards-plugin could someone move this?

@cwperks cwperks removed the untriaged label Oct 23, 2023
@cwperks
Copy link
Member

cwperks commented Oct 23, 2023

@opensearch-project/triage Can you please transfer this to the https://github.com/opensearch-project/security-analytics-dashboards-plugin repo?

@sandervandegeijn
Copy link
Author

Thanks Craig, couldn't make the meeting :)

@bbarani bbarani transferred this issue from opensearch-project/security-dashboards-plugin Oct 23, 2023
@amsiglan amsiglan transferred this issue from opensearch-project/security-analytics-dashboards-plugin Oct 26, 2023
@amsiglan
Copy link
Collaborator

Seems like we are trying to overwrite the mappings for the name field in the log type system index which is causing this mapping exception Mapper for [name] conflicts with existing mapper. Cannot update parameter [analyzer] from [default] to [whitespace] as seen in the video.

@sbcd90, @eirsep Can one of you looking why that might be happening?

@eirsep
Copy link
Member

eirsep commented Oct 27, 2023

Analyzer is property of the field in index mapping.

currently the issue is that you cannot change the mapping of an existing field. What you need to do if you want to change the mapping of existing documents is reindex those documents to another index with the updated mapping

So effectively, we are currently not supporting adding our own mappings.

We need the logs to investigate correctly but i have a hunch that this issue is from the query index. Will need to deep dive into the alerting query index logic and explore possibility of how we can copy over the analyzer parameter

@eirsep
Copy link
Member

eirsep commented Oct 27, 2023

@ict-one-nl can you provide the relevant server logs and stacktrace for this error to enable us to debug this issue.

@sandervandegeijn
Copy link
Author

Master node:

opensearch-master-nodes-0 opensearch-master-nodes org.opensearch.transport.RemoteTransportException: [opensearch-master-nodes-1][10.244.73.95:9300][indices:admin/mapping/put]
opensearch-master-nodes-0 opensearch-master-nodes Caused by: java.lang.IllegalArgumentException: Mapper for [name] conflicts with existing mapper:
opensearch-master-nodes-0 opensearch-master-nodes 	Cannot update parameter [analyzer] from [default] to [whitespace]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper$Conflicts.check(ParametrizedFieldMapper.java:572) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper.merge(ParametrizedFieldMapper.java:127) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper.merge(ParametrizedFieldMapper.java:76) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.ObjectMapper.doMerge(ObjectMapper.java:621) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.RootObjectMapper.doMerge(RootObjectMapper.java:351) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.ObjectMapper.merge(ObjectMapper.java:580) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.RootObjectMapper.merge(RootObjectMapper.java:346) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.Mapping.merge(Mapping.java:128) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.index.mapper.DocumentMapper.merge(DocumentMapper.java:307) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.cluster.metadata.MetadataMappingService$PutMappingExecutor.applyRequest(MetadataMappingService.java:283) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.cluster.metadata.MetadataMappingService$PutMappingExecutor.execute(MetadataMappingService.java:244) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.executeTasks(MasterService.java:874) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:424) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.runTasks(MasterService.java:295) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService$Batcher.run(MasterService.java:206) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:204) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:242) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:849) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedOpenSearchThreadPoolExecutor.java:282) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedOpenSearchThreadPoolExecutor.java:245) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-0 opensearch-master-nodes 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
opensearch-master-nodes-0 opensearch-master-nodes 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
opensearch-master-nodes-0 opensearch-master-nodes 	at java.lang.Thread.run(Thread.java:833) [?:?]

Second click on the button:

opensearch-master-nodes-1 opensearch-master-nodes [2023-10-28T11:09:05,301][ERROR][o.o.s.u.SecurityAnalyticsException] [opensearch-master-nodes-1] Security Analytics error:
opensearch-master-nodes-1 opensearch-master-nodes java.lang.IllegalArgumentException: Mapper for [name] conflicts with existing mapper:
opensearch-master-nodes-1 opensearch-master-nodes 	Cannot update parameter [analyzer] from [default] to [whitespace]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper$Conflicts.check(ParametrizedFieldMapper.java:572) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper.merge(ParametrizedFieldMapper.java:127) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper.merge(ParametrizedFieldMapper.java:76) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.ObjectMapper.doMerge(ObjectMapper.java:621) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.RootObjectMapper.doMerge(RootObjectMapper.java:351) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.ObjectMapper.merge(ObjectMapper.java:580) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.RootObjectMapper.merge(RootObjectMapper.java:346) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.Mapping.merge(Mapping.java:128) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.index.mapper.DocumentMapper.merge(DocumentMapper.java:307) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.cluster.metadata.MetadataMappingService$PutMappingExecutor.applyRequest(MetadataMappingService.java:283) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.cluster.metadata.MetadataMappingService$PutMappingExecutor.execute(MetadataMappingService.java:244) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.executeTasks(MasterService.java:874) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:424) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.runTasks(MasterService.java:295) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService$Batcher.run(MasterService.java:206) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:204) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:242) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:849) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedOpenSearchThreadPoolExecutor.java:282) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedOpenSearchThreadPoolExecutor.java:245) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
opensearch-master-nodes-1 opensearch-master-nodes 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
opensearch-master-nodes-1 opensearch-master-nodes 	at java.lang.Thread.run(Thread.java:833) [?:?]
opensearch-master-nodes-1 opensearch-master-nodes [2023-10-28T11:09:05,302][WARN ][r.suppressed             ] [opensearch-master-nodes-1] path: /_plugins/_security_analytics/logtype, params: {}
opensearch-master-nodes-1 opensearch-master-nodes org.opensearch.securityanalytics.util.SecurityAnalyticsException: Mapper for [name] conflicts with existing mapper:
opensearch-master-nodes-1 opensearch-master-nodes 	Cannot update parameter [analyzer] from [default] to [whitespace]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.securityanalytics.util.SecurityAnalyticsException.wrap(SecurityAnalyticsException.java:54) ~[?:?]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.securityanalytics.transport.TransportIndexCustomLogTypeAction$AsyncIndexCustomLogTypeAction.lambda$finishHim$0(TransportIndexCustomLogTypeAction.java:521) ~[?:?]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) [opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:908) [opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-1 opensearch-master-nodes 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
opensearch-master-nodes-1 opensearch-master-nodes 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
opensearch-master-nodes-1 opensearch-master-nodes 	at java.lang.Thread.run(Thread.java:833) [?:?]
opensearch-master-nodes-1 opensearch-master-nodes Caused by: java.lang.Exception: java.lang.IllegalArgumentException: Mapper for [name] conflicts with existing mapper:
opensearch-master-nodes-1 opensearch-master-nodes 	Cannot update parameter [analyzer] from [default] to [whitespace]
opensearch-master-nodes-1 opensearch-master-nodes 	... 9 more

Changed the name, back to:

opensearch-master-nodes-1 opensearch-master-nodes [2023-10-28T11:11:52,826][INFO ][o.o.p.PluginsService     ] [opensearch-master-nodes-1] PluginService:onIndexModule index:[.opensearch-sap-log-types-config/NfkU5ZeBQ9qWZ4K1eATQug]
opensearch-master-nodes-2 opensearch-master-nodes [2023-10-28T11:11:52,831][ERROR][o.o.s.u.SecurityAnalyticsException] [opensearch-master-nodes-2] Security Analytics error:
opensearch-master-nodes-2 opensearch-master-nodes org.opensearch.transport.RemoteTransportException: [opensearch-master-nodes-1][10.244.73.95:9300][indices:admin/mapping/put]
opensearch-master-nodes-2 opensearch-master-nodes Caused by: java.lang.IllegalArgumentException: Mapper for [name] conflicts with existing mapper:
opensearch-master-nodes-2 opensearch-master-nodes 	Cannot update parameter [analyzer] from [default] to [whitespace]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper$Conflicts.check(ParametrizedFieldMapper.java:572) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper.merge(ParametrizedFieldMapper.java:127) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.ParametrizedFieldMapper.merge(ParametrizedFieldMapper.java:76) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.ObjectMapper.doMerge(ObjectMapper.java:621) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.RootObjectMapper.doMerge(RootObjectMapper.java:351) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.ObjectMapper.merge(ObjectMapper.java:580) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.RootObjectMapper.merge(RootObjectMapper.java:346) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.Mapping.merge(Mapping.java:128) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.index.mapper.DocumentMapper.merge(DocumentMapper.java:307) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.cluster.metadata.MetadataMappingService$PutMappingExecutor.applyRequest(MetadataMappingService.java:283) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.cluster.metadata.MetadataMappingService$PutMappingExecutor.execute(MetadataMappingService.java:244) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.executeTasks(MasterService.java:874) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:424) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService.runTasks(MasterService.java:295) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.cluster.service.MasterService$Batcher.run(MasterService.java:206) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:204) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:242) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:849) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedOpenSearchThreadPoolExecutor.java:282) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedOpenSearchThreadPoolExecutor.java:245) ~[opensearch-2.11.0.jar:2.11.0]
opensearch-master-nodes-2 opensearch-master-nodes 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
opensearch-master-nodes-2 opensearch-master-nodes 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
opensearch-master-nodes-2 opensearch-master-nodes 	at java.lang.Thread.run(Thread.java:833) [?:?]

Does this help?

@amsiglan
Copy link
Collaborator

amsiglan commented Nov 1, 2023

@ict-one-nl Can you delete the .opensearch-sap-log-types-config index and then create the custom log type?

@sandervandegeijn
Copy link
Author

This is kind of a wipe the sheet clean solution and it doesn't solve the root cause. Is there a more elegant way?

@sbcd90
Copy link
Collaborator

sbcd90 commented Nov 2, 2023

hi @ict-one-nl , we have already created a github issue #708 to handle this scenario correctly.
But until the fix is in, you can use the workaround.

@sandervandegeijn
Copy link
Author

That helped, ish. I can create a new log type now. Updating the name of that newly created logtype gives:

opensearch-master-nodes-0 opensearch-master-nodes [2023-11-04T20:23:17,414][ERROR][o.o.s.u.SecurityAnalyticsException] [opensearch-master-nodes-0] Security Analytics error:
opensearch-master-nodes-0 opensearch-master-nodes org.opensearch.index.IndexNotFoundException: no such index [.opensearch-sap-custom-rules-config]

@sbcd90
Copy link
Collaborator

sbcd90 commented Nov 7, 2023

hi @ict-one-nl, does this newly created custom log type have any rules? if not, can you please create a custom rule?

@sandervandegeijn
Copy link
Author

I can create the logtype now in 2.11, deleting the test logtype is another matter:

image

@engechas
Copy link
Collaborator

engechas commented Apr 9, 2024

Resolved by above PRs

@engechas engechas closed this as completed Apr 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

7 participants