What is the bug?
Creating a threat detector fails with an HTTP 500 for any Sigma rule whose condition contains an aggregation expression.
An identical rule without that expression works fine so the failure appears to be specific to aggregation rules rather than to the rule content.
The response and logs show a NullPointerException raised while the detector is being created.
How can one reproduce the bug?
Steps to reproduce the behavior:
- Create a custom rule whose condition includes an aggregation expression.
- Create a detector that uses that rule.
- The request should fail with 500
What is the expected behavior?
The detector is created successfully.
What is your host/environment?
- OS: AlmaLinux
- Version: Wazuh indexer 5.0.0 beta 4, which bundles a distribution of this plugin.
{
"distribution": "opensearch",
"number": "3.6.0",
"build_type": "rpm",
"build_hash": "45b296a573609f1e584654ce26dbed02d07c91b7",
"build_date": "2026-07-22T10:00:53.425283350Z",
"build_snapshot": false,
"lucene_version": "10.4.0",
"minimum_wire_compatibility_version": "2.19.0",
"minimum_index_compatibility_version": "2.0.0"
}
- Plugins:
name component version
node-1 opensearch-cross-cluster-replication 3.6.0.0
node-1 opensearch-custom-codecs 3.6.0.0
node-1 opensearch-geospatial 3.6.0.0
node-1 opensearch-index-management 3.6.0.0
node-1 opensearch-job-scheduler 3.6.0.0
node-1 opensearch-security 3.6.0.0
node-1 wazuh-indexer-alerting 5.0.0.4
node-1 wazuh-indexer-content-manager 5.0.0.4
node-1 wazuh-indexer-notifications 5.0.0.4
node-1 wazuh-indexer-notifications-core 5.0.0.4
node-1 wazuh-indexer-reports-scheduler 5.0.0.4
node-1 wazuh-indexer-security-analytics 5.0.0.4
node-1 wazuh-indexer-setup 5.0.0.4
node-1 workload-management 3.6.0
Do you have any screenshots?
If applicable, add screenshots to help explain your problem.
Do you have any additional context?
I managed to reproduce this issue, here is the response:
{
"note": "create detector (aggregation rule)",
"request": "POST /_plugins/_security_analytics/detectors?error_trace=true",
"body": {
"type": "detector",
"name": "minrepro-agg",
"detector_type": "minrepro",
"enabled": true,
"threat_intel_enabled": false,
"schedule": {
"period": {
"interval": 2,
"unit": "MINUTES"
}
},
"inputs": [
{
"detector_input": {
"description": "minimal upstream NPE reproduction",
"indices": [
"wazuh-events-v5-system-activity"
],
"custom_rules": [
{
"id": "6c3209d3-d3dd-47ef-88ed-464cc39ea3e4"
}
],
"pre_packaged_rules": []
}
}
],
"triggers": []
},
"status": 500,
"response": {
"error": {
"root_cause": [
{
"type": "security_analytics_exception",
"reason": "Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null",
"stack_trace": "SecurityAnalyticsException[Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null]; nested: NullPointerException[Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null];\n\tat org.opensearch.securityanalytics.util.SecurityAnalyticsException.wrap(SecurityAnalyticsException.java:84)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$AsyncIndexDetectorsAction.lambda$finishHim$0(TransportIndexDetectorAction.java:2627)\n\tat org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74)\n\tat org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89)\n\tat org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1011)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\n\tat java.base/java.lang.Thread.run(Thread.java:1474)\nCaused by: java.lang.NullPointerException: Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getMappedField(OSQueryBackend.java:538)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getFinalField(OSQueryBackend.java:545)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.convertAggregation(OSQueryBackend.java:483)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction.createBucketLevelMonitorRequest(TransportIndexDetectorAction.java:1557)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1504)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1447)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getRuleFieldMappings$1(LogTypeService.java:872)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getAllFieldMappings$0(LogTypeService.java:580)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109)\n\tat org.opensearch.action.search.TransportSearchAction.lambda$doExecute$1(TransportSearchAction.java:343)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.search.pipeline.PipelinedRequest.lambda$transformResponseListener$1(PipelinedRequest.java:87)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.core.action.ActionListener$5.onResponse(ActionListener.java:268)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.sendSearchResponse(AbstractSearchAsyncAction.java:803)\n\tat org.opensearch.action.search.ExpandSearchPhase.run(ExpandSearchPhase.java:132)\n\tat org.opensearch.action.search.SearchPhase.recordAndRun(SearchPhase.java:62)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executePhase(AbstractSearchAsyncAction.java:514)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:481)\n\tat org.opensearch.action.search.FetchSearchPhase.moveToNextPhase(FetchSearchPhase.java:300)\n\tat org.opensearch.action.search.FetchSearchPhase.lambda$innerRun$1(FetchSearchPhase.java:138)\n\tat org.opensearch.action.search.FetchSearchPhase.innerRun(FetchSearchPhase.java:150)\n\tat org.opensearch.action.search.FetchSearchPhase$1.doRun(FetchSearchPhase.java:122)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59)\n\t... 5 more\n"
}
],
"type": "security_analytics_exception",
"reason": "Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null",
"caused_by": {
"type": "null_pointer_exception",
"reason": "Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null",
"stack_trace": "java.lang.NullPointerException: Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getMappedField(OSQueryBackend.java:538)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getFinalField(OSQueryBackend.java:545)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.convertAggregation(OSQueryBackend.java:483)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction.createBucketLevelMonitorRequest(TransportIndexDetectorAction.java:1557)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1504)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1447)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getRuleFieldMappings$1(LogTypeService.java:872)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getAllFieldMappings$0(LogTypeService.java:580)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109)\n\tat org.opensearch.action.search.TransportSearchAction.lambda$doExecute$1(TransportSearchAction.java:343)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.search.pipeline.PipelinedRequest.lambda$transformResponseListener$1(PipelinedRequest.java:87)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.core.action.ActionListener$5.onResponse(ActionListener.java:268)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.sendSearchResponse(AbstractSearchAsyncAction.java:803)\n\tat org.opensearch.action.search.ExpandSearchPhase.run(ExpandSearchPhase.java:132)\n\tat org.opensearch.action.search.SearchPhase.recordAndRun(SearchPhase.java:62)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executePhase(AbstractSearchAsyncAction.java:514)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:481)\n\tat org.opensearch.action.search.FetchSearchPhase.moveToNextPhase(FetchSearchPhase.java:300)\n\tat org.opensearch.action.search.FetchSearchPhase.lambda$innerRun$1(FetchSearchPhase.java:138)\n\tat org.opensearch.action.search.FetchSearchPhase.innerRun(FetchSearchPhase.java:150)\n\tat org.opensearch.action.search.FetchSearchPhase$1.doRun(FetchSearchPhase.java:122)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59)\n\tat org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1011)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\n\tat java.base/java.lang.Thread.run(Thread.java:1474)\n"
},
"stack_trace": "SecurityAnalyticsException[Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null]; nested: NullPointerException[Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null];\n\tat org.opensearch.securityanalytics.util.SecurityAnalyticsException.wrap(SecurityAnalyticsException.java:84)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$AsyncIndexDetectorsAction.lambda$finishHim$0(TransportIndexDetectorAction.java:2627)\n\tat org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74)\n\tat org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89)\n\tat org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1011)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\n\tat java.base/java.lang.Thread.run(Thread.java:1474)\nCaused by: java.lang.NullPointerException: Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getMappedField(OSQueryBackend.java:538)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getFinalField(OSQueryBackend.java:545)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.convertAggregation(OSQueryBackend.java:483)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction.createBucketLevelMonitorRequest(TransportIndexDetectorAction.java:1557)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1504)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1447)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getRuleFieldMappings$1(LogTypeService.java:872)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getAllFieldMappings$0(LogTypeService.java:580)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109)\n\tat org.opensearch.action.search.TransportSearchAction.lambda$doExecute$1(TransportSearchAction.java:343)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.search.pipeline.PipelinedRequest.lambda$transformResponseListener$1(PipelinedRequest.java:87)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.core.action.ActionListener$5.onResponse(ActionListener.java:268)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.sendSearchResponse(AbstractSearchAsyncAction.java:803)\n\tat org.opensearch.action.search.ExpandSearchPhase.run(ExpandSearchPhase.java:132)\n\tat org.opensearch.action.search.SearchPhase.recordAndRun(SearchPhase.java:62)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executePhase(AbstractSearchAsyncAction.java:514)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:481)\n\tat org.opensearch.action.search.FetchSearchPhase.moveToNextPhase(FetchSearchPhase.java:300)\n\tat org.opensearch.action.search.FetchSearchPhase.lambda$innerRun$1(FetchSearchPhase.java:138)\n\tat org.opensearch.action.search.FetchSearchPhase.innerRun(FetchSearchPhase.java:150)\n\tat org.opensearch.action.search.FetchSearchPhase$1.doRun(FetchSearchPhase.java:122)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59)\n\t... 5 more\n"
},
"status": 500
}
}Here is the stack trace in a readable manner:
SecurityAnalyticsException[Cannot invoke "java.util.Map.containsKey(Object)" because "this.fieldMappings" is null]; nested: NullPointerException[Cannot invoke "java.util.Map.containsKey(Object)" because "this.fieldMappings" is null];
at org.opensearch.securityanalytics.util.SecurityAnalyticsException.wrap(SecurityAnalyticsException.java:84)
at org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$AsyncIndexDetectorsAction.lambda$finishHim$0(TransportIndexDetectorAction.java:2627)
at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74)
at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89)
at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1011)
at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)
at java.base/java.lang.Thread.run(Thread.java:1474)
Caused by: java.lang.NullPointerException: Cannot invoke "java.util.Map.containsKey(Object)" because "this.fieldMappings" is null
at org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getMappedField(OSQueryBackend.java:538)
at org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getFinalField(OSQueryBackend.java:545)
at org.opensearch.securityanalytics.rules.backend.OSQueryBackend.convertAggregation(OSQueryBackend.java:483)
at org.opensearch.securityanalytics.transport.TransportIndexDetectorAction.createBucketLevelMonitorRequest(TransportIndexDetectorAction.java:1557)
at org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1504)
at org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1447)
at org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getRuleFieldMappings$1(LogTypeService.java:872)
at org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)
at org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getAllFieldMappings$0(LogTypeService.java:580)
at org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)
at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115)
at org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109)
at org.opensearch.action.search.TransportSearchAction.lambda$doExecute$1(TransportSearchAction.java:343)
at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)
at org.opensearch.search.pipeline.PipelinedRequest.lambda$transformResponseListener$1(PipelinedRequest.java:87)
at org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)
at org.opensearch.core.action.ActionListener$5.onResponse(ActionListener.java:268)
at org.opensearch.action.search.AbstractSearchAsyncAction.sendSearchResponse(AbstractSearchAsyncAction.java:803)
at org.opensearch.action.search.ExpandSearchPhase.run(ExpandSearchPhase.java:132)
at org.opensearch.action.search.SearchPhase.recordAndRun(SearchPhase.java:62)
at org.opensearch.action.search.AbstractSearchAsyncAction.executePhase(AbstractSearchAsyncAction.java:514)
at org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:481)
at org.opensearch.action.search.FetchSearchPhase.moveToNextPhase(FetchSearchPhase.java:300)
at org.opensearch.action.search.FetchSearchPhase.lambda$innerRun$1(FetchSearchPhase.java:138)
at org.opensearch.action.search.FetchSearchPhase.innerRun(FetchSearchPhase.java:150)
at org.opensearch.action.search.FetchSearchPhase$1.doRun(FetchSearchPhase.java:122)
at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)
at org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78)
at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)
at org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59)
... 5 more
What is the bug?
Creating a threat detector fails with an HTTP 500 for any Sigma rule whose condition contains an aggregation expression.
An identical rule without that expression works fine so the failure appears to be specific to aggregation rules rather than to the rule content.
The response and logs show a
NullPointerExceptionraised while the detector is being created.How can one reproduce the bug?
Steps to reproduce the behavior:
What is the expected behavior?
The detector is created successfully.
What is your host/environment?
Do you have any screenshots?
If applicable, add screenshots to help explain your problem.
Do you have any additional context?
I managed to reproduce this issue, here is the response:
{ "note": "create detector (aggregation rule)", "request": "POST /_plugins/_security_analytics/detectors?error_trace=true", "body": { "type": "detector", "name": "minrepro-agg", "detector_type": "minrepro", "enabled": true, "threat_intel_enabled": false, "schedule": { "period": { "interval": 2, "unit": "MINUTES" } }, "inputs": [ { "detector_input": { "description": "minimal upstream NPE reproduction", "indices": [ "wazuh-events-v5-system-activity" ], "custom_rules": [ { "id": "6c3209d3-d3dd-47ef-88ed-464cc39ea3e4" } ], "pre_packaged_rules": [] } } ], "triggers": [] }, "status": 500, "response": { "error": { "root_cause": [ { "type": "security_analytics_exception", "reason": "Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null", "stack_trace": "SecurityAnalyticsException[Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null]; nested: NullPointerException[Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null];\n\tat org.opensearch.securityanalytics.util.SecurityAnalyticsException.wrap(SecurityAnalyticsException.java:84)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$AsyncIndexDetectorsAction.lambda$finishHim$0(TransportIndexDetectorAction.java:2627)\n\tat org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74)\n\tat org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89)\n\tat org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1011)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\n\tat java.base/java.lang.Thread.run(Thread.java:1474)\nCaused by: java.lang.NullPointerException: Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getMappedField(OSQueryBackend.java:538)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getFinalField(OSQueryBackend.java:545)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.convertAggregation(OSQueryBackend.java:483)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction.createBucketLevelMonitorRequest(TransportIndexDetectorAction.java:1557)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1504)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1447)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getRuleFieldMappings$1(LogTypeService.java:872)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getAllFieldMappings$0(LogTypeService.java:580)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109)\n\tat org.opensearch.action.search.TransportSearchAction.lambda$doExecute$1(TransportSearchAction.java:343)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.search.pipeline.PipelinedRequest.lambda$transformResponseListener$1(PipelinedRequest.java:87)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.core.action.ActionListener$5.onResponse(ActionListener.java:268)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.sendSearchResponse(AbstractSearchAsyncAction.java:803)\n\tat org.opensearch.action.search.ExpandSearchPhase.run(ExpandSearchPhase.java:132)\n\tat org.opensearch.action.search.SearchPhase.recordAndRun(SearchPhase.java:62)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executePhase(AbstractSearchAsyncAction.java:514)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:481)\n\tat org.opensearch.action.search.FetchSearchPhase.moveToNextPhase(FetchSearchPhase.java:300)\n\tat org.opensearch.action.search.FetchSearchPhase.lambda$innerRun$1(FetchSearchPhase.java:138)\n\tat org.opensearch.action.search.FetchSearchPhase.innerRun(FetchSearchPhase.java:150)\n\tat org.opensearch.action.search.FetchSearchPhase$1.doRun(FetchSearchPhase.java:122)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59)\n\t... 5 more\n" } ], "type": "security_analytics_exception", "reason": "Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null", "caused_by": { "type": "null_pointer_exception", "reason": "Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null", "stack_trace": "java.lang.NullPointerException: Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getMappedField(OSQueryBackend.java:538)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getFinalField(OSQueryBackend.java:545)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.convertAggregation(OSQueryBackend.java:483)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction.createBucketLevelMonitorRequest(TransportIndexDetectorAction.java:1557)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1504)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1447)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getRuleFieldMappings$1(LogTypeService.java:872)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getAllFieldMappings$0(LogTypeService.java:580)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109)\n\tat org.opensearch.action.search.TransportSearchAction.lambda$doExecute$1(TransportSearchAction.java:343)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.search.pipeline.PipelinedRequest.lambda$transformResponseListener$1(PipelinedRequest.java:87)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.core.action.ActionListener$5.onResponse(ActionListener.java:268)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.sendSearchResponse(AbstractSearchAsyncAction.java:803)\n\tat org.opensearch.action.search.ExpandSearchPhase.run(ExpandSearchPhase.java:132)\n\tat org.opensearch.action.search.SearchPhase.recordAndRun(SearchPhase.java:62)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executePhase(AbstractSearchAsyncAction.java:514)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:481)\n\tat org.opensearch.action.search.FetchSearchPhase.moveToNextPhase(FetchSearchPhase.java:300)\n\tat org.opensearch.action.search.FetchSearchPhase.lambda$innerRun$1(FetchSearchPhase.java:138)\n\tat org.opensearch.action.search.FetchSearchPhase.innerRun(FetchSearchPhase.java:150)\n\tat org.opensearch.action.search.FetchSearchPhase$1.doRun(FetchSearchPhase.java:122)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59)\n\tat org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1011)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\n\tat java.base/java.lang.Thread.run(Thread.java:1474)\n" }, "stack_trace": "SecurityAnalyticsException[Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null]; nested: NullPointerException[Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null];\n\tat org.opensearch.securityanalytics.util.SecurityAnalyticsException.wrap(SecurityAnalyticsException.java:84)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$AsyncIndexDetectorsAction.lambda$finishHim$0(TransportIndexDetectorAction.java:2627)\n\tat org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74)\n\tat org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89)\n\tat org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1011)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)\n\tat java.base/java.lang.Thread.run(Thread.java:1474)\nCaused by: java.lang.NullPointerException: Cannot invoke \"java.util.Map.containsKey(Object)\" because \"this.fieldMappings\" is null\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getMappedField(OSQueryBackend.java:538)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.getFinalField(OSQueryBackend.java:545)\n\tat org.opensearch.securityanalytics.rules.backend.OSQueryBackend.convertAggregation(OSQueryBackend.java:483)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction.createBucketLevelMonitorRequest(TransportIndexDetectorAction.java:1557)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1504)\n\tat org.opensearch.securityanalytics.transport.TransportIndexDetectorAction$11.onResponse(TransportIndexDetectorAction.java:1447)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getRuleFieldMappings$1(LogTypeService.java:872)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.securityanalytics.logtype.LogTypeService.lambda$getAllFieldMappings$0(LogTypeService.java:580)\n\tat org.opensearch.core.action.ActionListener$3.onResponse(ActionListener.java:132)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:115)\n\tat org.opensearch.action.support.TransportAction$1.onResponse(TransportAction.java:109)\n\tat org.opensearch.action.search.TransportSearchAction.lambda$doExecute$1(TransportSearchAction.java:343)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.search.pipeline.PipelinedRequest.lambda$transformResponseListener$1(PipelinedRequest.java:87)\n\tat org.opensearch.core.action.ActionListener$1.onResponse(ActionListener.java:82)\n\tat org.opensearch.core.action.ActionListener$5.onResponse(ActionListener.java:268)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.sendSearchResponse(AbstractSearchAsyncAction.java:803)\n\tat org.opensearch.action.search.ExpandSearchPhase.run(ExpandSearchPhase.java:132)\n\tat org.opensearch.action.search.SearchPhase.recordAndRun(SearchPhase.java:62)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executePhase(AbstractSearchAsyncAction.java:514)\n\tat org.opensearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:481)\n\tat org.opensearch.action.search.FetchSearchPhase.moveToNextPhase(FetchSearchPhase.java:300)\n\tat org.opensearch.action.search.FetchSearchPhase.lambda$innerRun$1(FetchSearchPhase.java:138)\n\tat org.opensearch.action.search.FetchSearchPhase.innerRun(FetchSearchPhase.java:150)\n\tat org.opensearch.action.search.FetchSearchPhase$1.doRun(FetchSearchPhase.java:122)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78)\n\tat org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52)\n\tat org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59)\n\t... 5 more\n" }, "status": 500 } }Here is the stack trace in a readable manner: