Fresh install of hippocampe not working with Elasticsearch 5.3.x

[thehive-project]

Fresh install of hippocampe not working with Elasticsearch 5.3.x

[ninSmith]

Hi,

Try with ES 5.1 and see if it works

[ag-michael]

@ninSmith TheHive apparently needs at least ES 5.6 https://github.com/TheHive-Project/TheHiveDocs/blob/master/installation/install-guide.md#build-it-yourself

Not only that, I need to run a Kibana front end that supports csv exporting (even 5.6 does not support this). I can only upgrade at this point, can't downgrade. If you're wanting to see if the problem will get resolved this way, I can test Hippocampe with a test ES instance and let you know the results.

[kx499-zz]

I had the same issue on 5.2 - resolved it by nuking the hippocampe index and starting over

[kx499-zz]

I think the trick is to not create a default index in kibana until you run shadowbook and it completes. Honestly not sure though. Somehow the .kibana index and hippocampe index cause conflicts in the mappings. My best guess, not an ES guru by any stretch

[kx499-zz]

Additionally, if you want to use visualizations in kibana you need to update field types for description for search, source, and dashboard types. here's the example for search.

PUT /_all/_mapping/search?update_all_types
{
"properties": {
"description": {
"type": "text"
}
}
}

[ag-michael]

@kx499 how can I nuke the hippocampe index? I'm new to ES.

Visualizations are not important for me, but I do need hippocampe to use the ES instance as Kibana.

[kx499-zz]

curl -X DELETE "localhost:9200/hippocampe"

[ag-michael]

@ninSmith ES 5.6 works for me. However, I had to setup a dedicated ES instance. I wasn't able to test with Kibana.

Please leave this issue open, I will try to upgrade production ES to 5.6, get rid of kibana ,setup hippocampe and then reinstall Kibana.

[ag-michael]

I wanted to update and say I won't be having any free time soon to pursue troubleshooting this issue.
I'll leave it open in case the project is still interested in resolving this.