From ef9edf83d30a2b6541f13b5003d30e8a185cd3e1 Mon Sep 17 00:00:00 2001 From: AWSHurneyt Date: Thu, 24 Oct 2024 21:51:01 -0700 Subject: [PATCH] Added check to prevent resource_already_exists_exception when indexing more than 10k iocs. Signed-off-by: AWSHurneyt --- .../securityanalytics/services/STIX2IOCFeedStore.java | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCFeedStore.java b/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCFeedStore.java index 0d545f5be..215658436 100644 --- a/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCFeedStore.java +++ b/src/main/java/org/opensearch/securityanalytics/services/STIX2IOCFeedStore.java @@ -9,6 +9,7 @@ import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import org.opensearch.OpenSearchException; +import org.opensearch.ResourceAlreadyExistsException; import org.opensearch.action.DocWriteRequest; import org.opensearch.action.StepListener; import org.opensearch.action.admin.indices.create.CreateIndexRequest; @@ -35,6 +36,7 @@ import org.opensearch.securityanalytics.threatIntel.common.StashedThreadContext; import org.opensearch.securityanalytics.threatIntel.model.DefaultIocStoreConfig; import org.opensearch.securityanalytics.threatIntel.model.SATIFSourceConfig; +import org.opensearch.transport.RemoteTransportException; import java.io.ByteArrayOutputStream; import java.io.IOException; @@ -250,6 +252,11 @@ private void initFeedIndex(String feedIndexName, ActionListener { + if (e instanceof ResourceAlreadyExistsException || (e instanceof RemoteTransportException && e.getCause() instanceof ResourceAlreadyExistsException)) { + log.debug("index {} already exist", iocIndexMapping()); + listener.onResponse(null); + return; + } log.error("Failed to create system index {}", feedIndexName); listener.onFailure(e); }