Open cases not listed after deletion of merged case in UI

[ParanoidRat]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	CentOS
OS version (client)	Ubuntu
TheHive version	3.0.9
Package Type	Docker

Problem Description

After erroneously merging two cases, re-opening the original one (merged from) and deleting the re-opened duplicate, TheHive no longer shows open cases including the freshly created ones.

Logs suggest it could not find a case (presumably, the deleted one)

[warn] o.e.s.AuxSrv - Entity case AWMDI7ETzWNNoiOk2Lk1 not found,
[warn] o.e.s.AuxSrv - Entity case AWMDI7ETzWNNoiOk2Lk1 not found,
[info] o.e.ErrorHandler - GET /api/case/AWMDdUh6zWNNoiOk2Lll?nstats=true returned 404,
org.elastic4play.NotFoundError: case AWMDI7ETzWNNoiOk2Lk1 not found,
	at org.elastic4play.database.DBGet.$anonfun$apply$2(DBGet.scala:38),
	at scala.Option.fold(Option.scala:158),
	at org.elastic4play.database.DBGet.$anonfun$apply$1(DBGet.scala:38),
	at scala.util.Success.$anonfun$map$1(Try.scala:251),
	at scala.util.Success.map(Try.scala:209),
	at scala.concurrent.Future.$anonfun$map$1(Future.scala:289),
	at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:29),
	at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:29),
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60),
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55),
[warn] o.e.s.AuxSrv - Entity case AWMDI7ETzWNNoiOk2Lk1 not found,
[warn] o.e.s.AuxSrv - Entity case AWMDI7ETzWNNoiOk2Lk1 not found,
[warn] o.e.s.AuxSrv - Entity case AWMDI7ETzWNNoiOk2Lk1 not found,
[info] o.e.ErrorHandler - GET /api/case/task/AWMDI8TIljFRJkrq-gQ2 returned 404,
org.elastic4play.NotFoundError: case_task AWMDI8TIljFRJkrq-gQ2 not found,
	at org.elastic4play.database.DBGet.$anonfun$apply$2(DBGet.scala:38),
	at scala.Option.fold(Option.scala:158),
	at org.elastic4play.database.DBGet.$anonfun$apply$1(DBGet.scala:38),
	at scala.util.Success.$anonfun$map$1(Try.scala:251),
	at scala.util.Success.map(Try.scala:209),
	at scala.concurrent.Future.$anonfun$map$1(Future.scala:289),
	at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:29),
	at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:29),
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60),
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55),

Possible Solutions

Fix the backend Elasticsearch index by updating the document with mergedFrom property referencing the _id of the deleted case. Just in case, also remove "highlighting" property (TheHive shows highlighted notice in the UI that case has been merged into another case) referencing the _id of the deleted case. TheHive started to show all open cases.

[icoscx]

Deleting one of the merged cases results in UI Error failing to display all other OPEN cases that were not deleted.

o.e.ErrorHandler - GET /api/case/AWMaryMGHgVtySE5riXK?nstats=true returned 404
	org.elastic4play.NotFoundError: case AWMarXxSHgVtySE5riW- not found
	org.elastic4play.database.DBGet.$anonfun$apply$2(DBGet.scala:38)
	scala.Option.fold(Option.scala:158)
	org.elastic4play.database.DBGet.$anonfun$apply$1(DBGet.scala:38)
	scala.util.Success.$anonfun$map$1(Try.scala:251)
	scala.util.Success.map(Try.scala:209)
	scala.concurrent.Future.$anonfun$map$1(Future.scala:289)
	scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:29)
	scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:29)
	scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
	akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
o.e.s.AuxSrv - Entity case AWMat-oxHgVtySE5riXY not found
o.e.s.AuxSrv - Entity case AWMarXxSHgVtySE5riW- not found