Case statistics dashboard loads with an error message and the case over time panel fails to display any data

[steoleary]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu 18.04
OS version (client)	OS X 10.14
TheHive version / git hash	3.4.0-RC2
Package Type	RPM
Browser type & version	Chrome

Problem Description

Case statistics dashboard loads with an error message and the case over time panel fails to display any data:

Steps to Reproduce

1/ log into hive
2/ click dashboards
3/ select case statistics dashboard

Complementary information

application.log seems to show an elasticsearch error:

2019-07-11 13:03:14,822 [ERROR] from org.elastic4play.database.DBConfiguration in application-akka.actor.default-dispatcher-5 - ElasticSearch request failure: POST:/the_hive_15/_search?
StringEntity({"query":{"bool":{"must":[{"term":{"relations":{"value":"case"}}},{"range":{"createdAt":{"gt":"1554937200000","lt":"1562885999999"}}}]}},"size":0,"aggs":{"datehistogram_createdAt":{"date_histogram":{"interval":"1w","field":"createdAt"},"aggs":{"agg_1":{"filter":{"term":{"status":{"value":"Resolved"}}},"aggs":{"agg_1":{"avg":{"script":{"lang":"groovy","source":"(doc['endDate'].value - doc['startDate'].value) / 3600000"}}}}},"agg_2":{"filter":{"match_all":{}},"aggs":{"agg_2":{"filter":{"match_all":{}}}}}}}}},Some(application/json))
 => ElasticError(search_phase_execution_exception,all shards failed,None,None,None,List(ElasticError(illegal_argument_exception,script_lang not supported [groovy],None,None,None,null,None)),Some(CausedBy(illegal_argument_exception,script_lang not supported [groovy],Map())))
2019-07-11 13:03:14,827 [INFO] from org.elastic4play.ErrorHandler in application-akka.actor.default-dispatcher-5 - POST /api/case/_stats returned 400
org.elastic4play.SearchError: Invalid search query
	at org.elastic4play.database.DBFind$$anonfun$apply$4.applyOrElse(DBFind.scala:117)
	at org.elastic4play.database.DBFind$$anonfun$apply$4.applyOrElse(DBFind.scala:115)
	at scala.concurrent.Future.$anonfun$recoverWith$1(Future.scala:413)
	at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
	at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
	at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
	at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
	at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
	at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:40)
	at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:44)
	at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)
	at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)
	at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)
	at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)

[steoleary]

Doing a bit of research, it would appear that the groovy scripting language was removed in ES 6 and Painless should be used instead:
https://www.elastic.co/guide/en/elasticsearch/reference/6.0/breaking_60_scripting_changes.html

[nadouani]

Doing a bit of research, it would appear that the groovy scripting language was removed in ES 6 and Painless should be used instead:

This is bad, because computed fields use groovy expressions. We have to fix this

[To-om]

Fixed by TheHive-Project/elastic4play#92

[LukasFrey]

There seem to be other dashboard situations where using ES 6 breaks the thing.

E.g. when the value "computed.handlingDurationInHours" is used.

Tested with latest versions:

• TheHive 3.4.0
• ES 6.8.6