Observations/Indicators filtering by Creator

[RaulSokolova]

Description

Throws an unknown error in the UI.

ERROR:
{"category":"APP","error":{"data":{"category":"business","http_status":500,"reason":"[SEARCH] Sorting of field creator is only possible with elastic >=7.12"},"stacktrace":["UnsupportedError: Unsupported operation","at error (/opt/opencti/build/src/config/errors.js:8:10)","at UnsupportedError (/opt/opencti/build/src/config/errors.js:76:51)","at elQueryBodyBuilder (/opt/opencti/build/src/database/engine.js:1294:13)","at processTicksAndRejections (node:internal/process/task_queues:95:5)","at elPaginate (/opt/opencti/build/src/database/engine.js:1531:16)"]},"inner_relation_creation":0,"level":"error","message":"API Call","operation":"IndicatorsLinesPaginationQuery","operation_query":"query IndicatorsLinesPaginationQuery($search:String$count:Int!$cursor:ID$filters:

Environment

1. Docker deployment
2. OpenCTI version: 5.5.4
3. OpenSearch 1.3

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. { e.g. Run ... }
2. { e.g. Click ... }
3. { e.g. Error ... }

Expected Output

Actual Output

Additional information

Screenshots (optional)

[RaulSokolova]

I'm not able to reproduce it on the Demo page, so I will try to find if it's related to the data we have.

[richard-julien]

Sorting by creator is only possible with runtime mappings that is a feature not available on opensearch.

You should not be able to try to sort on creator on the interface if you not use elastic >=7.12

Do you try to setup the filter directly in the uri or you click on the table header?

[RaulSokolova]

Thanks @richard-julien, yeah it makes sense. No, we click in the table header, which crashes the UI and saves that filter in cached :( .

Ill be following this runtime mapping capability in the OpenSearch group and hope they get to add it soon. Dropping the link in case anyone needs the reference to the issue.

opensearch-project/OpenSearch#1133

[SamuelHassine]

@team : we need to remove the sorting when engine is not compatible in the "Indicators" list.