Visibility ES Mapping Issues

Sean Horn -

02-27-2017

There is a class of problems in Automate's Visibility component right now (version 0.6.64) that have to do with Elasticsearch indexing behavior. The symptoms of this behavior look like any of the following two exceptions in the /var/log/delivery/elasticsearch/current logfile . The problem may occur on any message with "resources." being indexed. The major symptom is that results do not show up for Inspec and Chef Client runs in the Visibility UI. 

This one occurs when Inspec run results should be flowing back into Visibility


2017-02-14_01:05:52.81291 RemoteTransportException[[Firearm][127.0.0.1:9300][indices:data/read/search[phase/query]]]; ne sted: SearchParseException[failed to parse search source [{"query":{"filtered":{"filter":{"bool":{"must":[{"term":{"even t_type":"inspec"}},{"term":{"compliance_summary.node_name":"rehearsal"}},{"range":{"compliance_summary.end_time":{"gte": "2016-11-16"}}}]}}}},"_source":["compliance_summary.node_name","run_id","profiles"],"sort":{"compliance_summary.end_time ":{"order":"desc"}},"size":1}]]; nested: SearchParseException[No mapping found for [compliance_summary.end_time] in orde r to sort on]; 2017-02-14_01:05:52.81291 Caused by: SearchParseException[failed to parse search source [{"query":{"filtered":{"filter": {"bool":{"must":[{"term":{"event_type":"inspec"}},{"term":{"compliance_summary.node_name":"rehearsal"}},{"range":{"compl iance_summary.end_time":{"gte":"2016-11-16"}}}]}}}},"_source":["compliance_summary.node_name","run_id","profiles"],"sort ":{"compliance_summary.end_time":{"order":"desc"}},"size":1}]]; nested: SearchParseException[No mapping found for [compl iance_summary.end_time] in order to sort on]; 2017-02-14_01:05:52.81292 at org.elasticsearch.search.SearchService.parseSource(SearchService.java:873)

 

This error occurs when a chef-client run has nested entries under the resources field of the report sent back to Visibility

2017-01-25_17:13:17.95172 MapperParsingException[failed to parse [resources.after.values]]; nested: IllegalArgumentException[unknown property [name]];
2017-01-25_17:13:17.95173       at org.elasticsearch.index.mapper.FieldMapper.parse(FieldMapper.java:329)


CON-513 Bug in Automate 0.6.64 Visibility where node data is not getting ingested when it has nested hashes below resources.after. Fixed in 0.6.84, confirmed fix definitely in 0.6.120 with a customer

Have more questions? Submit a request

Comments

Powered by Zendesk