Thehive: Not honoring mapping.nested_fields.limit

[derDuffy]

Request Type

Bug

Work Environment

| Question | Answer
|---------------------------|--------------------
| OS version (server) | Ubuntu
| OS version (client) | 10
| TheHive version / git hash | 3.0.10
| Package Type |DEB
| Browser type & version | Chrome

Problem Description

When adding more customfields in the template editor or in an an existing case one gets the following error message even though the config file has the limit at 300.
TemplateCtrl: Limit of nested fields [100] in index [the_hive_13] has been exceeded

Stack trace:

2018-07-26 17:26:21,533 [INFO] from org.elastic4play.ErrorHandler in application-akka.actor.default-dispatcher-78 - PATCH /api/case/AWTXL74dDzS4EDJyjwlN returned 400
org.elasticsearch.transport.RemoteTransportException: [fs0UMsj][127.0.0.1:9300][indices:data/write/update]
Caused by: org.elasticsearch.transport.RemoteTransportException: [fs0UMsj][127.0.0.1:9300][indices:data/write/update[s]]
Caused by: java.lang.IllegalArgumentException: Limit of nested fields [100] in index [the_hive_13] has been exceeded
        at org.elasticsearch.index.mapper.MapperService.checkNestedFieldsLimit(MapperService.java:597)
        at org.elasticsearch.index.mapper.MapperService.internalMerge(MapperService.java:445)
        at org.elasticsearch.index.mapper.MapperService.internalMerge(MapperService.java:336)
        at org.elasticsearch.index.mapper.MapperService.merge(MapperService.java:268)
        at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:311)
        at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:230)
        at org.elasticsearch.cluster.service.ClusterService.executeTasks(ClusterService.java:634)
        at org.elasticsearch.cluster.service.ClusterService.calculateTaskOutputs(ClusterService.java:612)
        at org.elasticsearch.cluster.service.ClusterService.runTasks(ClusterService.java:571)
        at org.elasticsearch.cluster.service.ClusterService$ClusterServiceTaskBatcher.run(ClusterService.java:263)
        at org.elasticsearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:150)
        at org.elasticsearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:188)
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:575)
        at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:247)
        at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:210)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)

Steps to Reproduce

1. Create lots of custom fields
2. Start adding them to a case tempalte until you get the error
3. Change the variable in application.conf
4. Still get the error

[nadouani]

Hello,

This setting is applied during ES index creation, so if you need to update it in an existing index, you need to make it on ES directly:

curl -X PUT "http://localhost:9200/THEHIVE_INDEX/_settings" -d'{"index.mapping.nested_fields.limit": 300}'

cc @Dominator-3000

Thanks to @cyberpescadito