Uploaded image for project: 'Ranger'
  1. Ranger
  2. RANGER-2905

Failed to log Audit event in Elasticsearch

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.1.0
    • Fix Version/s: 2.1.0
    • Component/s: audit
    • Labels:
      None

      Description

       

      Elasticsearch audit IndexRequest validation is failing due to empty (i.e empty string) type. 

      https://github.com/apache/ranger/blob/cd2165f4b81eff0f29edf30fe73c31d24d9f1d78/agents-audit/src/main/java/org/apache/ranger/audit/destination/ElasticSearchAuditDestination.java#L119

       

      Elasticsearch validation code:

      https://github.com/elastic/elasticsearch/blob/7.x/server/src/main/java/org/elasticsearch/action/index/IndexRequest.java#L215

       

      2020-07-08 22:55:24,740 ERROR org.apache.ranger.audit.provider.BaseAuditHandler: Error sending message to ElasticSearch
      org.elasticsearch.action.ActionRequestValidationException: Validation Failed: 1: type is missing;
              at org.elasticsearch.action.bulk.BulkRequest.validate(BulkRequest.java:393)
              at org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1480)
              at org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:1454)
              at org.elasticsearch.client.RestHighLevelClient.bulk(RestHighLevelClient.java:497)
              at org.apache.ranger.audit.destination.ElasticSearchAuditDestination.log(ElasticSearchAuditDestination.java:125)
              at org.apache.ranger.audit.queue.AuditBatchQueue.runLogAudit(AuditBatchQueue.java:309)
              at org.apache.ranger.audit.queue.AuditBatchQueue.run(AuditBatchQueue.java:215)
              at java.lang.Thread.run(Thread.java:748)
      2020-07-08 22:55:24,740 WARN org.apache.ranger.audit.provider.BaseAuditHandler: failed to log audit event:
      

      Elasticsearch version: 

       

       

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                pradeep Pradeep Agrawal
                Reporter:
                iammehrabalam Md Mehrab Alam
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: