Watcher: Internal Server Error

Elastic Stack Elasticsearch
1

Whenever I try to execute a watch i get a Watcher : Internal server error.

Also when I try to test the watch using development tools ,
i get following error

{
"error": {
"root_cause": [
{
"type": "null_pointer_exception",
"reason": null
}
],
"type": "null_pointer_exception",
"reason": null
},
"status": 500
}

2

is there any log file output that you can share or are you running on a cloud instance?

3

error [12:29:42.659] [null_pointer_exception] null :: {"path":"/_xpack/watcher/watch/_execute","query":{},"body":"{"trigger_data":{},"action_modes":{"my_webhook":"simulate"},"watch":{"metadata":{"xpack":{"type":"json"},"name":"A1"},"trigger":{"schedule":{"interval":"1m"}},"input":{"search":{"request":{"search_type":"query_then_fetch","indices":["logstash-*"],"types":[],"body":{"size":0,"query":{"match":{"severity":"alert"}}}}}},"condition":{"compare":{"ctx.payload.hits.total":{"gt":0}}},"actions":{"my_webhook":{"webhook":{"scheme":"http","host":"192.168.0.32","port":5601,"method":"post","path":"/api/notification_center/notification","params":{"type":"warning","content":"DFsdgfsdg"},"headers":{"Authorization":"Basic ZWxhc3RpYzphYmNkZTEyMzQ1","Content-type":"application/json","kbn-version":"6.2.3"},"body":"{ \"type\": \"error\", \"content\": \"{{ctx.payload.hits.total}}\" }"}}}}}","statusCode":500,"response":"{"error":{"root_cause":[{"type":"null_pointer_exception","reason":null}],"type":"null_pointer_exception","reason":null},"status":500}"}
at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:295:15)
at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:254:7)
at HttpConnector. (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:159:7)
at IncomingMessage.bound (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/dist/lodash.js:729:21)
at emitNone (events.js:91:20)
at IncomingMessage.emit (events.js:185:7)
at endReadableNT (_stream_readable.js:974:12)
at _combinedTickCallback (internal/process/next_tick.js:80:11)
at process._tickDomainCallback (internal/process/next_tick.js:128:9)

This is the error I get on the console when I try to execute any watch.

4

Sorry for not being clear. I meant in the elasticsearch logfile, not the kibana one.

5

also which elasticsearch version are you on?

6

The log file output is too big to paste in here. I have uploaded the file on google drive. Here's the link:
elasticseach_log

My elasticsearch version is 6.2.3

7

Hey,

can you run GET _xpack/watcher/stats and check if watcher is marked as stopped? If so, can you start watcher manually and see if you can run watcher then?

--Alex

8

The watcher was marked manually stopped. Manually starting it did the job.
Thanks a lot.

9

Thanks for reporting back. The error message is confusing though. This will be changed in 6.3 though, as a change about starting/stopping watcher (to reduce the code running in additional threads) will be included.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.