cortex 3.0.0-RC4 container : StreamSrv error popup spamming the setup page

[ITrustSI]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian
OS version (client)	9.9
TheHive version / git hash	3.0.0-RC4
Package Type	Docker (version 18.09.7)
Browser type & version	Chrome 75 / Firefox 60.7.2esr

Problem Description

Following my issue with TheHive setup, I also have a strange and annoying behavior with Cortex: I have the SteamSrv error rectangles filling the screen. It only stop flowing when I perform an action (Update the database, send the account creation form). Note: I only noticed this behavior on the setup pages.

Steps to Reproduce

1. Install Docker
2. Setup a fresh thehiveproject/cortex:3.0.0-RC4 install
3. Open the setup page in your web broswer

Complementary information

The Cortex configuration:

play.http.secret.key="..."

search {
  index = cortex
  uri = "http://elasticsearch:9200?cluster.name=hive"
}
cache.job = 10 minutes

## Authentication
auth {
	provider = [local]
}

## ANALYZERS
#
analyzer {
  urls = ["/opt/Cortex-Analyzers-2.1.7/analyzers"]

  fork-join-executor {
    parallelism-min = 2
    parallelism-factor = 2.0
    parallelism-max = 4
  }
}

## RESPONDERS
#
responders {
  urls = ["/opt/Cortex-Analyzers-2.1.7/responders"]

  fork-join-executor {
    parallelism-min = 2
    parallelism-factor = 2.0
    parallelism-max = 4
  }
}

A screenshot so you get an idea of the bug:

An extract from the Cortex logs :

[info] p.c.s.AkkaHttpServer - Enabling HTTP/2 on Akka HTTP server...
[info] p.c.s.AkkaHttpServer - Listening for HTTP on /0.0.0.0:9001
[error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/cortex_4/_search?
StringEntity({"query":{"match":{"relations":{"query":"user"}}},"size":0},Some(application/json))
 => ElasticError(index_not_found_exception,no such index,Some(_na_),Some(cortex_4),None,List(ElasticError(index_not_found_exception,no such index,Some(_na_),Some(cortex_4),None,null,None)),None)
[error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/cortex_4/_search?
StringEntity({"version":"true","query":{"ids":{"values":["init"]}},"size":1},Some(application/json))
 => ElasticError(index_not_found_exception,no such index,Some(_na_),Some(cortex_4),None,List(ElasticError(index_not_found_exception,no such index,Some(_na_),Some(cortex_4),None,null,None)),None)
[info] o.t.c.s.ErrorHandler - GET /api/user/current returned 520
org.elastic4play.IndexNotFoundException$: null
	at org.elastic4play.IndexNotFoundException$.<clinit>(Errors.scala)
	at org.elastic4play.database.DBConfiguration.$anonfun$execute$2(DBConfiguration.scala:145)
	at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:307)
	at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
	at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
	at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
	at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
	at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
[error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/cortex_4/_search?
StringEntity({"query":{"match":{"relations":{"query":"user"}}},"size":0},Some(application/json))
 => ElasticError(index_not_found_exception,no such index,Some(_na_),Some(cortex_4),None,List(ElasticError(index_not_found_exception,no such index,Some(_na_),Some(cortex_4),None,null,None)),None)
[info] o.t.c.s.ErrorHandler - GET /api/stream/6yfESvddC1 returned 401
org.elastic4play.AuthenticationError: Authentication header not found
	at org.elastic4play.controllers.Authenticated.$anonfun$getFromApiKey$1(Authenticated.scala:143)
	at scala.Option.fold(Option.scala:175)
	at org.elastic4play.controllers.Authenticated.getFromApiKey(Authenticated.scala:143)
	at org.thp.cortex.controllers.StreamCtrl.$anonfun$get$1(StreamCtrl.scala:97)
	at play.api.mvc.ActionBuilderImpl.invokeBlock(Action.scala:488)
	at play.api.mvc.ActionBuilderImpl.invokeBlock(Action.scala:486)
	at play.api.mvc.ActionBuilder$$anon$10.apply(Action.scala:425)
	at play.api.mvc.Action.$anonfun$apply$2(Action.scala:97)
	at play.api.libs.streams.StrictAccumulator.$anonfun$mapFuture$4(Accumulator.scala:183)
	at scala.util.Try$.apply(Try.scala:213)
[error] o.e.d.DBConfiguration - ElasticSearch request failure: POST:/cortex_4/_search?
StringEntity({"query":{"match":{"relations":{"query":"user"}}},"size":0},Some(application/json))
 => ElasticError(index_not_found_exception,no such index,Some(_na_),Some(cortex_4),None,List(ElasticError(index_not_found_exception,no such index,Some(_na_),Some(cortex_4),None,null,None)),None)
[info] o.t.c.s.ErrorHandler - GET /api/stream/gcTyJxy0ES returned 401

Thank you!

[ITrustSI]

Note : I have similar error messages ([info] o.e.ErrorHandler - GET /api/stream/$STREAM_ID$ returned 401) in the TheHive RC2, but not with the same consequences. Could this be related?
See Cannot setup TheHive 3.4.0-RC2 using Docker

[nadouani]

Hello, was you able to move forward when clicking on the update database etc...

We will take a look to that issue with the notification toasters.

[ITrustSI]

Hello,
Yes, I was able to go through the setup process (updating the database and filling/submitting account creation form) despite the error spam.
Then, when reaching the login page, the bug is gone.

[nadouani]

Well this occurs when the ES index doesn't exit, we will fix it.