-
Notifications
You must be signed in to change notification settings - Fork 614
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Docker-Compose ElasticSearch incompatibility #1140
Comments
Experimenting with this hypothesis now |
Reverting seems pretty fruitless |
It looks like Cortex 3.0.0 and TheHive 3.4.0 are "supposed" to be compatible with ES 6+. https://blog.thehive-project.org/2019/09/11/thehive-3-4-0-cortex-3-0-0-released/ |
I was able to get it running with the following compose file (Removed the RC tags and used the latest stable versions).
|
@arnydo Nice. Would it be worth investigating a way to run a script to do this automatically on ElasticSearch container creation? |
Maybe. I'll have to see if I can replicate it. May have just been a fluke.
If it's consistent then I don't see why not.
…On Fri, Oct 11, 2019, 3:20 PM Miles Florence ***@***.***> wrote:
@arnydo <https://github.com/arnydo> Nice. Would it be worth investigating
a way to run a script to do this automatically on ElasticSearch container
creation?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#1140?email_source=notifications&email_token=ACY47VYUUK6CES6JB7VVXETQODGYLA5CNFSM4I7S2N72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEBA65GI#issuecomment-541191833>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACY47VZOK437L543PEBMVFDQODGYLANCNFSM4I7S2N7Q>
.
|
@arnydo Is this it?
EDIT:
|
I think it was /the_hive_15....
…On Fri, Oct 11, 2019, 3:29 PM Miles Florence ***@***.***> wrote:
@arnydo <https://github.com/arnydo> Is this it?
curl -X DELETE "http://172.18.0.2:9200/thehive"
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#1140?email_source=notifications&email_token=ACY47VYBH4L443CAMT5D243QODHZBA5CNFSM4I7S2N72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEBA7RMQ#issuecomment-541194418>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACY47V7CFEP46H272Q64NXTQODHZBANCNFSM4I7S2N7Q>
.
|
Hmm... What makes it 15? It is hardcoded somewhere in the project? Is it the 15th container on your environment? |
Something with how it's setup in Elastic search 6 now.
https://github.com/TheHive-Project/TheHiveDocs/blob/cea352d0614515791dda758dbca4aef2747da157/admin/upgrade_to_thehive_3_4_and_es_6_x.md
…On Fri, Oct 11, 2019, 3:38 PM Miles Florence ***@***.***> wrote:
Hmm... What makes it 15?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#1140?email_source=notifications&email_token=ACY47V4TGU3TZXHI2AU7ASLQODI2JA5CNFSM4I7S2N72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEBBAHOY#issuecomment-541197243>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACY47VYQYDJ6LSCF6R6SDOTQODI2JANCNFSM4I7S2N7Q>
.
|
Yeah, looks to be the hardcoded name they're going with. It's not immediately clear what the 15 signifies though. I'll take a stab at this and if it works I'll make a PR. The subject of this ticket has changed, should I edit the original post or leave as is? |
the_hive_15 relates to the schema version. v3.2/3.3 were using
'the_hive_14' in elastic.
https://github.com/TheHive-Project/TheHiveDocs/blob/master/admin/schema_version.md
…On Sat., 12 Oct. 2019, 06:48 Miles Florence, ***@***.***> wrote:
Yeah, looks to be the hardcoded name they're going with. It's not
immediately clear what the 15 signifies though. I'll take a stab at this
and if it works I'll make a PR.
The subject of this ticket has changed, should I edit the original post or
leave as is?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#1140?email_source=notifications&email_token=AGWR3JCUGY67LHGSYCVF2NLQODKARA5CNFSM4I7S2N72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEBBBBMI#issuecomment-541200561>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AGWR3JF4WGGDG2FQNTUDQ6DQODKARANCNFSM4I7S2N7Q>
.
|
Got back to this. Strange behavior when cUrl'ing from TheHive's container
|
Logs of starting up the compose and opening hxxp://localhost[:]9000/
|
PR: #1144 |
Docker-Compose ElasticSearch incompatibility
Request Type
Bug
Work Environment
Problem Description
The docker compose file creates an ElasticSearch container that is incompatible with the rest of the deployment.
Steps to Reproduce
master
./docker/thehive
docker-compose up
in this directoryPossible Solutions
Potentially, reverting this PR will remediate the issue. According to the docs, this project uses ElasticSearch5.0 for stateless storage. Despite this spec, the file was altered to have a major version bump.
Either way, the Docker file and documentation are out of sync.
Complementary information
Sample error. One of many, but I'm cropping out any PII.
The text was updated successfully, but these errors were encountered: