search

TheHive-Project / Hippocampe

Threat Feed Aggregation, Made Easy
https://thehive-project.org
GNU Affero General Public License v3.0
166 stars 44 forks source link

Error when adding a new feed #57

Open AlexFaraino opened 6 years ago

AlexFaraino commented 6 years ago

Request Type

Bug

Work Environment

Question Answer
OS version (server) Alpine 3.4
OS version (client) Win10
Hippocampe version / git hash f4d8807651eb44ad810c9697be0bb169e5402665
Package Type Docker
Browser type & version N/A
Elasticsearch version 5.5

Problem Description

When adding a new feed and launching shadowbook, I got this error on the new feed: ["TransportError(400, u'illegal_argument_exception', u\"Can't parse [index] value [not_analyzed] for field [source], expected [true] or [false]\")"] from Elasticsearch.

Steps to Reproduce

  1. Remove a feeds from the core/conf/feed directory
  2. Launch Hippocampe for the first time, on a new index and launch shadowbook
  3. Then, shutdown Hippocampe and restore the deleted feed
  4. Launch Hippocampe and launch Shadowbook again
  5. When shadowbook is finished, the new feed got the mentioned error

Possible Solutions

Looking at the Elasticsearch doc, index parameter should be True or False (false by default). https://www.elastic.co/guide/en/elasticsearch/reference/5.6/keyword.html In core/services/modules/shadowbook/objects/IndexIntel.py, index parameter for field "source" is "not_analyzed".