{"action":"created","issue":{"url":"https://api.github.com/repos/StamusNetworks/SELKS/issues/107","repository_url":"https://api.github.com/repos/StamusNetworks/SELKS","labels_url":"https://api.github.com/repos/StamusNetworks/SELKS/issues/107/labels{/name}","comments_url":"https://api.github.com/repos/StamusNetworks/SELKS/issues/107/comments","events_url":"https://api.github.com/repos/StamusNetworks/SELKS/issues/107/events","html_url":"https://github.com/StamusNetworks/SELKS/issues/107","id":299618232,"number":107,"title":"SN Alerts -  no info. Doesn't exist on mappings","user":{"login":"berekese","id":29145477,"avatar_url":"https://avatars3.githubusercontent.com/u/29145477?v=4","gravatar_id":"","url":"https://api.github.com/users/berekese","html_url":"https://github.com/berekese","followers_url":"https://api.github.com/users/berekese/followers","following_url":"https://api.github.com/users/berekese/following{/other_user}","gists_url":"https://api.github.com/users/berekese/gists{/gist_id}","starred_url":"https://api.github.com/users/berekese/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/berekese/subscriptions","organizations_url":"https://api.github.com/users/berekese/orgs","repos_url":"https://api.github.com/users/berekese/repos","events_url":"https://api.github.com/users/berekese/events{/privacy}","received_events_url":"https://api.github.com/users/berekese/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-02-23T07:06:32Z","updated_at":"2018-02-26T14:00:23Z","closed_at":null,"author_association":"NONE","body":"Hi, \r\nI can't check alerts in that dashboard and I dont know if its why I haven't logs there o why any info isn't been processed correctly.\r\n\r\nHere log when I do click on \"SN Alert\" on main dashboard Scirius:\r\n\r\n```\r\nError: Request to Elasticsearch failed: {\"error\":{\"root_cause\":[{\"type\":\"script_exception\",\"reason\":\"link error\",\"script_stack\":[\"doc['alert.signature_id'].value\",\"     ^---- HERE\"],\"script\":\"doc['alert.signature_id'].value\",\"lang\":\"expression\"}],\"type\":\"search_phase_execution_exception\",\"reason\":\"all shards failed\",\"phase\":\"query\",\"grouped\":true,\"failed_shards\":[{\"shard\":0,\"index\":\"logstash-tls-2018.02.22\",\"node\":\"Nl5UnDlZSUykAUiPr2Hk4A\",\"reason\":{\"type\":\"script_exception\",\"reason\":\"link error\",\"script_stack\":[\"doc['alert.signature_id'].value\",\"     ^---- HERE\"],\"script\":\"doc['alert.signature_id'].value\",\"lang\":\"expression\",\"caused_by\":{\"type\":\"parse_exception\",\"reason\":\"Field [alert.signature_id] does not exist in mappings\"}}}]},\"status\":500}\r\nKbnError@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:84:18358\r\nRequestFailure@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:84:19107\r\nCallResponseHandlersProvider/callResponseHandlers/<@https://192.168.XX.XX/bundles/kibana.bundle.js?v=15610:29:12752\r\n[344]/</Promise.try@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:83:22243\r\n[344]/</Promise.map/<@https://192.168.100.XX/bundles/commons.bundle.js?v=15610:83:21588\r\n[344]/</Promise.map@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:83:21553\r\ncallResponseHandlers@https://192.168.XX.XX/bundles/kibana.bundle.js?v=15610:29:12360\r\nFetchTheseProvider/fetchWithStrategy/<@https://192.168.XX.XX/bundles/kibana.bundle.js?v=15610:29:623\r\nprocessQueue@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:38:23621\r\n[16]/qFactory/scheduleProcessQueue/<@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:38:23888\r\n$eval@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:39:4607\r\n$digest@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:39:2343\r\n$apply@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:39:5026\r\ndone@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:37:25016\r\ncompleteRequest@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:37:28702\r\n[16]/createHttpBackend/</xhr.onload@https://192.168.XX.XX/bundles/commons.bundle.js?v=15610:37:29634\r\n```\r\nThanks as always."},"comment":{"url":"https://api.github.com/repos/StamusNetworks/SELKS/issues/comments/368512315","html_url":"https://github.com/StamusNetworks/SELKS/issues/107#issuecomment-368512315","issue_url":"https://api.github.com/repos/StamusNetworks/SELKS/issues/107","id":368512315,"user":{"login":"pevma","id":1405917,"avatar_url":"https://avatars3.githubusercontent.com/u/1405917?v=4","gravatar_id":"","url":"https://api.github.com/users/pevma","html_url":"https://github.com/pevma","followers_url":"https://api.github.com/users/pevma/followers","following_url":"https://api.github.com/users/pevma/following{/other_user}","gists_url":"https://api.github.com/users/pevma/gists{/gist_id}","starred_url":"https://api.github.com/users/pevma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pevma/subscriptions","organizations_url":"https://api.github.com/users/pevma/orgs","repos_url":"https://api.github.com/users/pevma/repos","events_url":"https://api.github.com/users/pevma/events{/privacy}","received_events_url":"https://api.github.com/users/pevma/received_events","type":"User","site_admin":false},"created_at":"2018-02-26T14:00:23Z","updated_at":"2018-02-26T14:00:23Z","author_association":"CONTRIBUTOR","body":"Try the following.\r\nOn a working SELKS - you mentioned you have a box where things were working as expected in term of dashboards - \r\n- cd /usr/share/python/scirius/\r\n- source bin/activate\r\n- python bin/manage.py kibana_export --full\r\n- deactivate\r\n\r\nIn the current directory you should have a full export of the default dashboards (unless you have changed something in terms of - you have custom dashboard names etc...)\r\nSo for example a file that looks something like - ``scirius-dashboards-201802261355.tar.bz2``.\r\n\r\nThen try to import those onto the box that you have troubles with."}}
{"actor":{"display_login":"pevma"}}