{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/162","repository_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app","labels_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/162/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/162/comments","events_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/162/events","html_url":"https://github.com/wazuh/wazuh-kibana-app/issues/162","id":284600780,"number":162,"title":"Wazuh ElasticStack Upgrade Errors","user":{"login":"hafeezy2j","id":31100825,"avatar_url":"https://avatars2.githubusercontent.com/u/31100825?v=4","gravatar_id":"","url":"https://api.github.com/users/hafeezy2j","html_url":"https://github.com/hafeezy2j","followers_url":"https://api.github.com/users/hafeezy2j/followers","following_url":"https://api.github.com/users/hafeezy2j/following{/other_user}","gists_url":"https://api.github.com/users/hafeezy2j/gists{/gist_id}","starred_url":"https://api.github.com/users/hafeezy2j/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hafeezy2j/subscriptions","organizations_url":"https://api.github.com/users/hafeezy2j/orgs","repos_url":"https://api.github.com/users/hafeezy2j/repos","events_url":"https://api.github.com/users/hafeezy2j/events{/privacy}","received_events_url":"https://api.github.com/users/hafeezy2j/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2017-12-26T19:36:45Z","updated_at":"2018-02-05T12:19:25Z","closed_at":null,"author_association":"NONE","body":"I have recently upgraded wazuh from 2.X to 3.X and now I'm getting following errors in  /var/log/elasticsearch/elasticsearch.log\r\n\r\n[2017-12-26T13:24:51,876][DEBUG][o.e.a.b.TransportShardBulkAction] [wazuh-alerts-2017.12.26][0] failed to execute bulk item (index) BulkShardRequest [[wazuh-alerts-2017.12.26][0]] containing [18] requests\r\norg.elasticsearch.index.mapper.MapperParsingException: failed to parse [data]\r\n        at org.elasticsearch.index.mapper.FieldMapper.parse(FieldMapper.java:302) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.DocumentParser.parseObjectOrField(DocumentParser.java:485) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.DocumentParser.parseObject(DocumentParser.java:500) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.DocumentParser.innerParseObject(DocumentParser.java:394) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.DocumentParser.parseObjectOrNested(DocumentParser.java:384) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.DocumentParser.internalParseDocument(DocumentParser.java:93) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.DocumentParser.parseDocument(DocumentParser.java:67) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:261) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.shard.IndexShard.prepareIndex(IndexShard.java:708) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.shard.IndexShard.applyIndexOperation(IndexShard.java:686) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.shard.IndexShard.applyIndexOperationOnPrimary(IndexShard.java:667) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.bulk.TransportShardBulkAction.executeIndexRequestOnPrimary(TransportShardBulkAction.java:548) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.bulk.TransportShardBulkAction.executeIndexRequest(TransportShardBulkAction.java:140) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.bulk.TransportShardBulkAction.executeBulkItemRequest(TransportShardBulkAction.java:236) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.bulk.TransportShardBulkAction.performOnPrimary(TransportShardBulkAction.java:123) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.bulk.TransportShardBulkAction.shardOperationOnPrimary(TransportShardBulkAction.java:110) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.bulk.TransportShardBulkAction.shardOperationOnPrimary(TransportShardBulkAction.java:72) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$PrimaryShardReference.perform(TransportReplicationAction.java:1033) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$PrimaryShardReference.perform(TransportReplicationAction.java:1011) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.ReplicationOperation.execute(ReplicationOperation.java:104) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$AsyncPrimaryAction.onResponse(TransportReplicationAction.java:358) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$AsyncPrimaryAction.onResponse(TransportReplicationAction.java:298) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$1.onResponse(TransportReplicationAction.java:974) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$1.onResponse(TransportReplicationAction.java:971) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.shard.IndexShardOperationPermits.acquire(IndexShardOperationPermits.java:238) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.shard.IndexShard.acquirePrimaryOperationPermit(IndexShard.java:2211) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction.acquirePrimaryShardReference(TransportReplicationAction.java:983) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction.access$500(TransportReplicationAction.java:97) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$AsyncPrimaryAction.doRun(TransportReplicationAction.java:319) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$PrimaryOperationTransportHandler.messageReceived(TransportReplicationAction.java:294) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.action.support.replication.TransportReplicationAction$PrimaryOperationTransportHandler.messageReceived(TransportReplicationAction.java:281) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:66) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.transport.TransportService$7.doRun(TransportService.java:652) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:637) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.1.0.jar:6.1.0]\r\n        at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:1.8.0_144]\r\n        at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:1.8.0_144]\r\n        at java.lang.Thread.run(Unknown Source) [?:1.8.0_144]\r\nCaused by: java.lang.IllegalStateException: Can't get text on a START_OBJECT at 1:579\r\n        at org.elasticsearch.common.xcontent.json.JsonXContentParser.text(JsonXContentParser.java:85) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.common.xcontent.support.AbstractXContentParser.textOrNull(AbstractXContentParser.java:237) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.KeywordFieldMapper.parseCreateField(KeywordFieldMapper.java:315) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        at org.elasticsearch.index.mapper.FieldMapper.parse(FieldMapper.java:297) ~[elasticsearch-6.1.0.jar:6.1.0]\r\n        ... 38 more\r\n\r\n\r\nAny clue what could be causing this ??\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/comments/363068886","html_url":"https://github.com/wazuh/wazuh-kibana-app/issues/162#issuecomment-363068886","issue_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/162","id":363068886,"user":{"login":"hafeezy2j","id":31100825,"avatar_url":"https://avatars2.githubusercontent.com/u/31100825?v=4","gravatar_id":"","url":"https://api.github.com/users/hafeezy2j","html_url":"https://github.com/hafeezy2j","followers_url":"https://api.github.com/users/hafeezy2j/followers","following_url":"https://api.github.com/users/hafeezy2j/following{/other_user}","gists_url":"https://api.github.com/users/hafeezy2j/gists{/gist_id}","starred_url":"https://api.github.com/users/hafeezy2j/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hafeezy2j/subscriptions","organizations_url":"https://api.github.com/users/hafeezy2j/orgs","repos_url":"https://api.github.com/users/hafeezy2j/repos","events_url":"https://api.github.com/users/hafeezy2j/events{/privacy}","received_events_url":"https://api.github.com/users/hafeezy2j/received_events","type":"User","site_admin":false},"created_at":"2018-02-05T12:19:25Z","updated_at":"2018-02-05T12:19:25Z","author_association":"NONE","body":"Hello @havidarou,\r\n\r\nNo I dont.  if I uninstall elasticsearch and install the 6.1.1 version, I dont see these errors. dont know if doing so will cause any issues for the rest of upgrade process..\r\n\r\nThanks,"}}
{"actor":{"display_login":"hafeezy2j"}}