Unable to fetch mapping. Do you have indices matching the pattern?

[SAFAA-HAZAR]

Hi,
I get this warning in kibana's dashboard : Unable to fetch mapping. Do you have indices matching the pattern?

I am sure that VulnWhisperer do not download data from Nessus to elasticsearch , here is the output of :

vuln_whisperer -c frameworks_example.ini -s nessus

[INFO] Connected to database at /opt/vulnwhisperer/database1/report_tracker.db
[INFO] Attempting to connect to nessus...
/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py:858: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)
/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py:858: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)
[SUCCESS] Connected to nessus on localhost:8834
/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py:858: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)
[INFO] Gathering all scan data... this may take a while...
/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py:858: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)
[INFO] Identified 1 scans to be processed
[INFO] Directory already exist for /opt/vulnwhisperer/nessus/My Scans - Skipping creation
/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py:858: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
InsecureRequestWarning)

I don't get any error in kibana's and elasticsearch' logs .

Please advise.

[qmontal]

Hi @SAFAA-HAZAR ,

I would recommend you checking the logstash logs, I had a similar issue and the reason of logstash breaking and not parsing the logs was because I copied as it was all of the files at the logstash folder (https://github.com/austin-taylor/VulnWhisperer/tree/master/logstash), and rabbitmq was making logstash crash.

In order to solve it, I removed all the logstash config files except from the ones I was actually needing. You can also test using the following command specified at the README.md file:

sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/1000_nessus_process_file.conf

And see if logstash processes the logs without breaking, sending them to ElasticSearch successfully.

Hope this fixes your issue.

Regards,

Quim

[SAFAA-HAZAR]

Thank you .
You made my day :D
This solved the problem.

[qmontal]

Glad it helped :)

@austin-taylor maybe we should use the Wiki tab to create a FAQ in order to have visible this kind of issues that might interest to other people? :)

[qmontal]

Closing issue, a FAQ entry in VulnWhisperer's wiki has been created pointing to this issue in case future cases appear.