[Question] - Switch from Lucene to Elastic

[alemau01]

Request Type

Question

Work Environment

Question	Answer
TheHive version / git hash	4.1.17
Package Type	Docker
Database	Cassandra
Index type	Lucene / Elasticsearch
Attachments storage	Local

Question

Hello, i have an instance of thehive (4.1.17) configured with cassandra and lucene. I would like to switch from lucene to elastic but after i change the configuration the following error occurs:

org.janusgraph.graphdb.configuration.GraphDatabaseConfiguration
Local setting index.search.backend=elasticsearch (Type: GLOBAL_OFFLINE) is overridden by globally managed value (lucene). Use the ManagementSystem interface instead of the local configuration to control this setting.

How can i handle and fix this issue?

Thanks

Here some reference i found on the web: https://docs.janusgraph.org/v0.4/basics/configuration-reference/

[fandigunawan]

Did you try the following configuration sample from documentation?

## Database Configuration
db {
  provider: janusgraph
  janusgraph {
    ## Storage configuration
    storage {
      backend: cql
      hostname: ["10.1.2.1", "10.1.2.2", "10.1.2.3"]
      ## Cassandra authentication (if configured)
      username: "thehive_account"
      password: "cassandra_password"
      cql {
        cluster-name: thp
        keyspace: thehive
      }
    }
    ## Index configuration
    index {
      search {
        backend : elasticsearch
        hostname : ["10.1.2.5"]
        index-name : thehive
        elasticsearch {
          http {
            auth {
              type: basic
              basic {
                username: httpuser
                password: httppassword
              }
            }
          }
          ssl {
            enabled: true
            truststore {
              location: /path/to/your/truststore.jks
              password: truststorepwd
            }
          }
        }
      }
    }
  }
}                

[alemau01]

Yes i already do it but the same error occurs. I found a tool in thehive/bin call cloner but there is no documentation about that

[SrijanNandi]

Facing the same issue..

2022-12-01 19:48:11,432 [WARN] from org.janusgraph.diskstorage.configuration.builder.ReadConfigurationBuilder in application-akka.actor.default-dispatcher-13 [|] Local setting index.search.index-name=scalligraph (Type: GLOBAL_OFFLINE) is overridden by globally managed value (thehive).  Use the ManagementSystem interface instead of the local configuration to control this setting.
2022-12-01 19:48:11,434 [WARN] from org.janusgraph.diskstorage.configuration.builder.ReadConfigurationBuilder in application-akka.actor.default-dispatcher-13 [|] Local setting index.search.backend=lucene (Type: GLOBAL_OFFLINE) is overridden by globally managed value (elasticsearch).  Use the ManagementSystem interface instead of the local configuration to 
```control this setting.

[Sn0wAlice]

Hello same issue here on TheHive 5

facing problem from v 5.0.25 (always error, same after update & k8s namespace reset)

Local setting index.search.backend=elasticsearch (Type: GLOBAL_OFFLINE) is overridden by globally managed value (lucene). Use the ManagementSystem interface instead of the local configuration to control this setting.

Fun fact: we do not change any conf, the problem appears like if a ghost comes in our infrastructure 👻