Limit of total field in ES 7.6.1

[mareban]

Hello,

I've update vuls to the latest version and trying to push the results to ES 7.6.1 and get this error message : "[2021-12-12T17:24:21,155][INFO ][o.e.a.b.TransportShardBulkAction] [llnelasticpoc2] [vulsbeat-8.0.0-2021.12.12][0] mapping update rejected by primary
java.lang.IllegalArgumentException: Limit of total fields [10000] in index [vulsbeat-8.0.0-2021.12.12] has been exceeded
"

Do i miss something in the config, does vulsbeat works with opensearch 1.1, does vulsbeat provides dashboards ?

Thanks for your help and for this nice project :-)

[kazuminn]

@mareban

Thank you for your report.

Please refer to this site and raise the limit.

maybe vulsbeat cat custom dashboads.
Will you try it with version 1.1? If you can't, give me an issue.

https://stackoverflow.com/questions/55372330/what-does-limit-of-total-fields-1000-in-index-has-been-exceeded-means-in

[mareban]

It's not 1000 but 10000 :-( ! Why so many fields ?

So, for the dashboards, do you have a template please ?

Thanks for your help.

[mareban]

Happy new year !

I've reinstall vulsbeat, upload the index template, do a scan with vuls and try to upload the results and still have a limit index of 10000 fields raised :-( !

Maybe i have to choose a right processor to limit the number of fields to index ? Do you have an example please ?

Thanks for your help

[kazuminn]

Isn't there a lot of data when there are many fields? How many servers are you scanning? Also, how many vulnerabilities are there in each server?

[mareban]

Thanks for your reply !

Only one for test, and there are +20 vuls with vuls tui !

Before we used vulslogconverter that seems to be not maintained anymore, that index +50 fields , i hope that vulsbeat that is recommended , have more or less this amount of fields ?

Thanks for your help.

[mareban]

Hello,

I've try several things, but i always get "field name cannot be empty" !!

I've tried on ES 7.6.1 and Opensearch 1.2.3, created the dynamic template exported from vulsbeat, and cannot use vulsbeat yet :-( ! Debug logging on vulsbeat and ES or Opensearch is activated, but no idea on what is wrong ! Only one machine where scan (no container scan) !

Can someone help please ?