Thehive: [Bug] Case statistics dashboard loads with an error

[24kuznec]

Case statistics dashboard loads with an error message and the case over time widget fails to display data

Request Type

Bug TheHive3

Work Environment

| Question | Answer
|---------------------------|--------------------
| OS version (server) | CentOS Linux release 8.2.2004
| OS version (client) | Windows 10 Pro (1909)
| TheHive version / git hash | 3.5.0-1
| Package Type | RPM
| Browser type & version | Chrome, Microsoft Edge

Problem Description

Case statistics dashboard loads with an error message and the case over time widget fails to display data

Steps to Reproduce

1. Successful Logon to TheHive
2. Select menu dashboard and case statistics dashboard
3. Click button edit
4. Click button edit widget case over time
5. On the series tab, click add series
6. I choose the "computer.handlingDurationInHours" and click "Apply"

1. And....

Complementary information

/var/log/thehive/application.log

2020-11-07 23:09:32,129 [ERROR] from org.elastic4play.database.DBConfiguration in application-akka.actor.default-dispatcher-69 - ElasticSearch request failure: POST:/the_hive_16/_search?
StringEntity({"query":{"bool":{"must":[{"term":{"relations":{"value":"case"}}},{"range":{"createdAt":{"gt":"1596819600000","lt":"1604854799999"}}}]}},"size":0,"aggs":{"datehistogram_createdAt":{"date_histogram":{"calendar_interval":"1w","field":"createdAt"},"aggs":{"agg_1":{"filter":{"term":{"status":{"value":"Resolved"}}},"aggs":{"agg_1":{"avg":{"script":{"lang":"painless","source":"(doc['endDate'].date.getMillis() - doc['startDate'].date.getMillis()) / 3600000"}}}}},"agg_2":{"filter":{"match_all":{}},"aggs":{"agg_2":{"filter":{"match_all":{}}}}}}}}},Some(application/json))
=> ElasticError(search_phase_execution_exception,all shards failed,None,None,None,List(ElasticError(script_exception,runtime error,None,None,None,null,None,None,None,null)),None,Some(query),Some(true),List(FailedShard(0,Some(the_hive_16),Some(EBfTQ2DkTIaSTGg8v0A9bA),Some(ElasticError(script_exception,runtime error,None,None,None,null,Some(CausedBy(illegal_argument_exception,Illegal list shortcut value [date].,Map())),None,None,null)))))
2020-11-07 23:09:32,130 [INFO] from org.elastic4play.ErrorHandler in application-akka.actor.default-dispatcher-69 - POST /api/case/_stats returned 400
org.elastic4play.SearchError: Invalid search query
at org.elastic4play.database.DBFind$$anonfun$apply$4.applyOrElse(DBFind.scala:118)
at org.elastic4play.database.DBFind$$anonfun$apply$4.applyOrElse(DBFind.scala:116)
at scala.concurrent.Future.$anonfun$recoverWith$1(Future.scala:417)
at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:56)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:93)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:93)
at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:48)
at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:48)
at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:175)

[nadouani]

Looks like the inline scripts are not enable in elasticsearch, could you check that?

https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-scripting-security.html

[24kuznec]

Looks like the inline scripts are not enable in elasticsearch, could you check that?

https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-scripting-security.html

Hello, Nabil Adouani!
This option is enabled. Screenshot of settings in elasticsearch.yml

[24kuznec]

Additionally. Previously, I performed migration procedures from ES 5.6, through re-index, to ES 6.x, after which I updated to ES 7.x. The migration procedures were carried out in accordance with the instructions (upgrade_to_thehive_3_4_and_es_6_x.md and upgrade_to_thehive_3_5_and_es_7_x.md) (and for the Сortex according to similar instructions). But, I did a fresh (clean) install too (TH-3.5.0-1 C-3.1.0-1 ES-7.x). The problem with dashboards was exactly the same.