Invalid searches lead to read error messages

[crackytsi]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian
OS version (client)	Seven using Chrome Browser
TheHive version / git hash	3.0.9
Package Type	DEB

Problem Description

Search for the following string: "caseId: #1"
(remove quotations).

This leads to not understandable error message:
SearchSrv: failed to create query: { "bool" : { "must" : [ { "bool" : { "must" : [ { "query_string" : { "query" : "caseId: #1", "fields" : [ ], "use_dis_max" : true, "tie_breaker" : 0.0, "default_operator" : "or", "auto_generate_phrase_queries" : false, "max_determinized_states" : 10000, "enable_position_increments" : true, "fuzziness" : "AUTO", "fuzzy_prefix_length" : 0, "fuzzy_max_expansions" : 50, "phrase_slop" : 0, "escape" : false, "split_on_whitespace" : true, "boost" : 1.0 } }, { "query_string" : { "query" : "!_type:audit AND !_type:data AND !_type:user AND !_type:analyzer AND !_type:case_artifact_job_log AND !status:Deleted", "fields" : [ ], "use_dis_max" : true, "tie_breaker" : 0.0, "default_operator" : "or", "auto_generate_phrase_queries" : false, "max_determinized_states" : 10000, "enable_position_increments" : true, "fuzziness" : "AUTO", "fuzzy_prefix_length" : 0, "fuzzy_max_expansions" : 50, "phrase_slop" : 0, "escape" : false, "split_on_whitespace" : true, "boost" : 1.0 } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } }, { "bool" : { "must_not" : [ { "term" : { "status" : { "value" : "Deleted", "boost" : 1.0 } } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } }, { "bool" : { "must_not" : [ { "bool" : { "should" : [ { "term" : { "_type" : { "value" : "audit", "boost" : 1.0 } } }, { "term" : { "_type" : { "value" : "data", "boost" : 1.0 } } }, { "term" : { "_type" : { "value" : "user", "boost" : 1.0 } } }, { "term" : { "_type" : { "value" : "analyzer", "boost" : 1.0 } } }, { "term" : { "_type" : { "value" : "misp", "boost" : 1.0 } } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } } ], "disable_coord" : false, "adjust_pure_negative" : true, "boost" : 1.0 } }

[nadouani]

There is nothing to do here except catch the error message and display a human readable message.

The search section will be revamped in a future release to allow a more structured search capabilities like the way we define filters in dashboards.