Post 2.4.90 -> 2.4.100 upgrade, index field type conflict

[geistchevalier]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

6

RAM

64GB

Storage for /

500GB

Storage for /nsm

2TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

In reference to this discussion: Post 2.4.100 upgrade from 2.4.90, Dashboard menu : System Windows Security errors

I was having issues with opening the dashboard after the update from 2.4.90 to 2.4.100, getting a 500 response (as above), even after running the patch commands. Long story short I went through the aforementioned discussion above and discovered the following issues,
removing the following filters groupby source.ip | groupby destination.ip allows the dashboard to be loaded as usual

---

going through the mappings for the component templates, I'm guessing that it's the dynamic mapping that's assigning properties like destination.ip to the type keyword instead of the type ip

---

so I added the mapping for the properties to the appropriate datatype

---

My questions are:

1. Do I need to define it in logs-iis.access@custom instead of logs-iis.access@package? Will these changes persist through SO updates?
2. After rolling over the index to adopt the new template, do I need to close (and delete?) the older indexes that are in conflict? or can I leave it as is?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

#13725

This will be fixed in 2.4.110. The above will show you the changes needed. You would then want to rollover your datastream.

If you want the conflict to go away, you can reindex the affected datastreams.

[geistchevalier]

Thanks for linking that, I'll follow the changes in the pull request referenced in there before 2.4.110 comes