Petr Fedchenkov created RANGER-4676: ---------------------------------------
Summary: OpenSearch destination implementation Key: RANGER-4676 URL: https://issues.apache.org/jira/browse/RANGER-4676 Project: Ranger Issue Type: Improvement Components: audit Reporter: Petr Fedchenkov OpenSearch has its own java library to connect with and is not fully compatible with bulk requests using elasticsearch library (at least v7). So let's implement another destination. With current elasticsearch destination I can see problems with response parsing: 23/09/22 10:13:20 ERROR BaseAuditHandler: Error sending message to ElasticSearch java.io.IOException: Unable to parse response body for Response\{requestLine=POST /_bulk?timeout=1m HTTP/1.1, host=http://nia-spark-fedchenkov.ru-central1.internal:9200, response=HTTP/1.1 200 OK} at org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1651) at org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1602) at org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:1572) at org.elasticsearch.client.RestHighLevelClient.bulk(RestHighLevelClient.java:537) at org.apache.ranger.audit.destination.ElasticSearchAuditDestination.log(ElasticSearchAuditDestination.java:141) at org.apache.ranger.audit.queue.AuditBatchQueue.runLogAudit(AuditBatchQueue.java:309) at org.apache.ranger.audit.queue.AuditBatchQueue.run(AuditBatchQueue.java:215) at java.base/java.lang.Thread.run(Thread.java:829) Caused by: java.lang.NullPointerException at java.base/java.util.Objects.requireNonNull(Objects.java:221) at org.elasticsearch.action.DocWriteResponse.<init>(DocWriteResponse.java:127) at org.elasticsearch.action.index.IndexResponse.<init>(IndexResponse.java:54) at org.elasticsearch.action.index.IndexResponse.<init>(IndexResponse.java:39) at org.elasticsearch.action.index.IndexResponse$Builder.build(IndexResponse.java:107) at org.elasticsearch.action.index.IndexResponse$Builder.build(IndexResponse.java:104) at org.elasticsearch.action.bulk.BulkItemResponse.fromXContent(BulkItemResponse.java:159) at org.elasticsearch.action.bulk.BulkResponse.fromXContent(BulkResponse.java:188) at org.elasticsearch.client.RestHighLevelClient.parseEntity(RestHighLevelClient.java:1911) at org.elasticsearch.client.RestHighLevelClient.lambda$performRequestAndParseEntity$8(RestHighLevelClient.java:1573) at org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1649) ... 7 more -- This message was sent by Atlassian Jira (v8.20.10#820010)