[Bug] Migration tool migrates unsupported elastic index

[mamoedo]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu
TheHive source version / git hash	3.4.2
TheHive target version / git hash	4.1.1

Problem Description

I am using the migration tool to migrate from THv3.4.2 to 4.1.1 going through 3.5.1. In my elastic i have _15 and _17 indexes.

When i use the migration tool i am having problems because the tool is trying to use _15 index and deeping on the code i think if this portion of code (https://github.com/TheHive-Project/TheHive/blob/main/migration/src/main/scala/org/thp/thehive/migration/th3/DBConfiguration.scala#L208)

val index_3_5_1 = indexBaseName + "_17"
val index_3_5_0 = indexBaseName + "_16"

because the val _15 is for 3.4.2

val index_3_4_2 = indexBaseName + "_15"

Possible Solutions

Change this code to use _17 index

[To-om]

@mamoedo you're right, nice catch

[leroy3893]

Creating an alias _15 in the Elasticsearch for _17 can solve the problem too

[nunofranciscomoreira]

What about not appending anything to the value passed on the "-i, --es-index" flags???? Or at least document that you do this appending.

That sounds like something you would expect a script to do, specially when it allows the user to specify values as parameters, don't you think?

Just so you know, the change breaks the migration for installations with the index the_hive_15 which worked before.

[mamoedo]

@nunofranciscomoreira but migration is not supported from TH 3.4, which is the one tha has the_hive_15 as index. So even if you could migrate that index, it wouldn't be supported as they said on the docs.

[nunofranciscomoreira]

The whole point of this tool was to migrate stuff from 3 to 4. It supported 3.4 until this stupid change.

[mamoedo]

@nunofranciscomoreira I'm sorry that you think that the change it's stupid, but TH 3.4 was never supposed to be supported, but TH 3.5 did, so this change is neccesary. TH 3.4 is not the same as TH 3.5.

[nunofranciscomoreira]

Please read the docs.
It clearly reads: "All packages of TheHive4 distributed come with the migration program which can be used to import data from TheHive 3.4.0+. By default, it is installed in /opt/thehive/bin/migrate."

[mamoedo]

Sorry I was thinking about TH4.1X which is "the good one"

[nunofranciscomoreira]

Creating an alias _15 in the Elasticsearch for _17 can solve the problem too

I'm currently trying the alias workaround and it looks promising.

Sorry I was thinking about TH4.1X which is "the good one"

I'm glad that we can see clear now 😃 I've tried, with no luck, to build a "fixed" version on my machine, but I'm getting all sort of errors while building using ./sbt. Adding the indexBaseName + "_15" back should fix it for good.