[filebeat][threatintel][MISP] "cannot access method/field [size] from a null def reference"

[righel]

Every time Elastic pulls data from MISP it requests an additional page, then it fails to parse the empty response and gives an error.

Relevant log:

{
  "@timestamp": [
    "2024-04-05T12:34:43.201Z"
  ],
  "agent.ephemeral_id": [
    "23da4333-6b6d-4808-b28c-b87c0e6b0bca"
  ],
  "agent.hostname": [
    "ab6ce874b844"
  ],
  "agent.id": [
    "0f9297be-6c84-465c-b2e8-fb8b5d4c8d4c"
  ],
  "agent.name": [
    "ab6ce874b844"
  ],
  "agent.type": [
    "filebeat"
  ],
  "agent.version": [
    "8.12.2"
  ],
  "ecs.version": [
    "1.12.0"
  ],
  "error.message": [
    "cannot access method/field [size] from a null def reference"
  ],
  "event.category": [
    "threat"
  ],
  "event.created": [
    "2024-04-05T12:34:43.201Z"
  ],
  "event.dataset": [
    "threatintel.misp"
  ],
  "event.ingested": [
    "2024-04-05T12:34:53.198Z"
  ],
  "event.kind": [
    "enrichment"
  ],
  "event.module": [
    "threatintel"
  ],
  "event.original": [
    "{\"response\":[]}"
  ],
  "event.timezone": [
    "+00:00"
  ],
  "event.type": [
    "indicator"
  ],
  "fileset.name": [
    "misp"
  ],
  "host.architecture": [
    "x86_64"
  ],
  "host.containerized": [
    false
  ],
  "host.hostname": [
    "ab6ce874b844"
  ],
  "host.ip": [
    "172.23.0.9"
  ],
  "host.mac": [
    "02-42-AC-17-00-09"
  ],
  "host.name": [
    "ab6ce874b844"
  ],
  "host.os.codename": [
    "focal"
  ],
  "host.os.family": [
    "debian"
  ],
  "host.os.kernel": [
    "5.15.49-linuxkit"
  ],
  "host.os.name": [
    "Ubuntu"
  ],
  "host.os.name.text": [
    "Ubuntu"
  ],
  "host.os.platform": [
    "ubuntu"
  ],
  "host.os.type": [
    "linux"
  ],
  "host.os.version": [
    "20.04.6 LTS (Focal Fossa)"
  ],
  "input.type": [
    "httpjson"
  ],
  "service.type": [
    "threatintel"
  ],
  "tags": [
    "threatintel-misp",
    "forwarded"
  ],
  "threat.indicator.provider": [
    "misp"
  ],
  "_id": "WUtBro4BZoTdDFnhNvST",
  "_index": ".ds-filebeat-8.12.2-2024.04.02-000001",
  "_score": null
}

Do you think its a bug @chrisberkhout ?

For confirmed bugs, please report:

• Version: 8.12.2
• Operating System: Docker
• Discuss Forum URL: https://discuss.elastic.co/t/filebeat-threat-intel-module-errors/319225/2
• Steps to Reproduce:
  1. Add a Threat Intel MISP integration in Filebeat
  2. Every time Elastic pulls Events from MISP it requests a +1 page, due to issues on MISP pagination logic (see: [filebeat][threatintel] MISP pagination fixes #37898).
  3. The processor fails to parse the empty response from MISP and an error log saved to Elasticsearch.

[botelastic]

This issue doesn't have a Team:<team> label.

[chrisberkhout]

Thanks for the report @righel. I think it is a bug. I've opened #38917 to fix it.

[righel]

Thanks!