-
Type:
Bug
-
Status: Resolved
-
Priority:
Minor
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: Audit
-
Tags:
-
Team:PLATFORM
-
Sprint:nxplatform #87
-
Story Points:2
The extended.params can be persisted in the audit entry when tracking activity of a page provider.
When the audit is stored in elastic, the type of extended.params can be keyword or objects, but mixing both types create indexing errors;
Unable to index audit entry 0 :ElasticsearchException[Elasticsearch exception [type=mapper_parsing_exception, reason=failed to parse field [extended.params] of type [keyword] in document with id '126398496']]; nested: ElasticsearchException[Elasticsearch exception [type=illegal_state_exception, reason=Can't get text on a START_OBJECT at 1:1834]];
the default mapping for extended.params is indeed a keyword.
"extended" : {
"properties" : {
...
"pageProviderName" : {
"type" : "keyword",
"ignore_above" : 256
},
"params" : {
"type" : "keyword",
"ignore_above" : 256
},
...
Because we don't need to search on this field it shouldn't be indexed.
---------
The mapping has been adapted for new instances, for existing instances it requires to create a new index,
follow the documentation on how to purge audit index which has been adapted to ignore the extended.params:
https://doc.nuxeo.com/nxdoc/purging-audit-logs-nxp_logs/#purging-audit-with-elasticsearch-backend
