{"action":"created","issue":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1178","repository_url":"https://api.github.com/repos/cuckoosandbox/cuckoo","labels_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1178/labels{/name}","comments_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1178/comments","events_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1178/events","html_url":"https://github.com/cuckoosandbox/cuckoo/issues/1178","id":190814941,"number":1178,"title":"Elasticsearch v5 Error WIth Cuckoov2-RC2?","user":{"login":"keithjjones","id":5360855,"avatar_url":"https://avatars.githubusercontent.com/u/5360855?v=3","gravatar_id":"","url":"https://api.github.com/users/keithjjones","html_url":"https://github.com/keithjjones","followers_url":"https://api.github.com/users/keithjjones/followers","following_url":"https://api.github.com/users/keithjjones/following{/other_user}","gists_url":"https://api.github.com/users/keithjjones/gists{/gist_id}","starred_url":"https://api.github.com/users/keithjjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keithjjones/subscriptions","organizations_url":"https://api.github.com/users/keithjjones/orgs","repos_url":"https://api.github.com/users/keithjjones/repos","events_url":"https://api.github.com/users/keithjjones/events{/privacy}","received_events_url":"https://api.github.com/users/keithjjones/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":14,"created_at":"2016-11-21T19:38:33Z","updated_at":"2016-11-30T15:32:02Z","closed_at":null,"body":"I have a fresh install of Cuckoo v2-RC2 on a mac working really well.  I tried to tie it to Elasticsearch through brew (v5 is now the current version there).  I'm getting these errors and no data is being saved to ES.  Any ideas?  Is this a bug?\r\n\r\n```\r\n2016-11-21 14:28:13,279 [elasticsearch] WARNING: POST /cuckoov2-1-2016/cuckoo?op_type=create [status:400 request:0.026s]\r\n2016-11-21 14:28:13,294 [lib.cuckoo.core.plugins] WARNING: The reporting module \"ElasticSearch\" returned the following error: Failed to save results in ElasticSearch for task #1: TransportError(400, u'action_request_validation_exception', u'Validation Failed: 1: an id must be provided if version type or value are set;')\r\n```\r\n\r\nThat's all it says in cuckoo.log.\r\n\r\nThis is the relevant reporting.conf information I am using:\r\n\r\n```\r\n[elasticsearch]\r\nenabled = yes\r\n# Comma-separated list of ElasticSearch hosts. Format is IP:PORT, if port is\r\n# missing the default port is used.\r\n# Example: hosts = 127.0.0.1:9200, 192.168.1.1:80\r\nhosts = 127.0.0.1:9200\r\n# Set to yes if we want to be able to search every API call instead of just\r\n# through the behavioral summary.\r\ncalls = no\r\n# Index of this Cuckoo instance. If multiple Cuckoo instances connect to the\r\n# same ElasticSearch host then this index (in Moloch called \"instance\") should\r\n# be unique for each Cuckoo instance.\r\n#\r\nindex = cuckoov2-1\r\n#\r\n# Logging time pattern.  This sets how elasticsearch creates indexes\r\n# by default it is yearly in most instances this will be sufficient\r\n# valid options: yearly, monthly, daily\r\n#\r\nindex_time_pattern = yearly\r\n#\r\n# Cuckoo node name in Elasticsearch to identify reporting host. Can be useful\r\n# for automation and while referring back to correct Cuckoo host. \r\n#\r\n# cuckoo_node = \"cuckoo.example.host\"\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/comments/263903394","html_url":"https://github.com/cuckoosandbox/cuckoo/issues/1178#issuecomment-263903394","issue_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/1178","id":263903394,"user":{"login":"keithjjones","id":5360855,"avatar_url":"https://avatars.githubusercontent.com/u/5360855?v=3","gravatar_id":"","url":"https://api.github.com/users/keithjjones","html_url":"https://github.com/keithjjones","followers_url":"https://api.github.com/users/keithjjones/followers","following_url":"https://api.github.com/users/keithjjones/following{/other_user}","gists_url":"https://api.github.com/users/keithjjones/gists{/gist_id}","starred_url":"https://api.github.com/users/keithjjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keithjjones/subscriptions","organizations_url":"https://api.github.com/users/keithjjones/orgs","repos_url":"https://api.github.com/users/keithjjones/repos","events_url":"https://api.github.com/users/keithjjones/events{/privacy}","received_events_url":"https://api.github.com/users/keithjjones/received_events","type":"User","site_admin":false},"created_at":"2016-11-30T15:32:02Z","updated_at":"2016-11-30T15:32:02Z","body":"Here is some more.  I --cleaned and tried again.  Then I cleaned out the ES index with Curl and restarted the daemon.\r\n\r\n```\r\nINFO:cuckoo.process:Task #5: queueing for reporting\r\nWARNING:elasticsearch:POST /cuckoo-2016/cuckoo?op_type=create [status:400 request:0.414s]\r\nWARNING:lib.cuckoo.core.plugins:The reporting module \"ElasticSearch\" returned the following error: Failed to save results in ElasticSearch for task #2: TransportError(400, u'mapper_parsing_exception', u'failed to parse')\r\nERROR:lib.cuckoo.core.plugins:Failed to run the reporting module \"MongoDB\":\r\nTraceback (most recent call last):\r\n  File \"/Source/cuckoo-dev/utils/../lib/cuckoo/core/plugins.py\", line 533, in process\r\n    current.run(self.results)\r\n  File \"/Source/cuckoo-dev/utils/../modules/reporting/mongodb.py\", line 253, in run\r\n    self.db.analysis.save(report)\r\n  File \"/Source/Python2/lib/python2.7/site-packages/pymongo/collection.py\", line 1903, in save\r\n    check_keys, manipulate, write_concern)\r\n  File \"/Source/Python2/lib/python2.7/site-packages/pymongo/collection.py\", line 430, in _insert\r\n    gen(), check_keys, self.codec_options, sock_info)\r\nDocumentTooLarge: BSON document too large (17399311 bytes) - the connected server supports BSON document sizes up to 16777216 bytes.\r\n```"}}
{"actor":{"display_login":"keithjjones"}}