FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
nmathur
Staff
Staff
Article Id 246046
Description This article describes that Elasticsearch backup fails while backing up Elasticsearch data on a FortiSOAR instance that had been upgraded from 7.2.x to 7.3.x.
Scope FortiSOAR instance that had been upgraded from 7.2.x to 7.3.x.
Solution

The Elasticsearch backup fails while backing up Elasticsearch data, using the csadm backup command, on a FortiSOAR instance that had been upgraded from 7.2.x to 7.3.x with an error such as:
"elasticsearch.exceptions.TransportError: TransportError(500, 'repository_exception', "[es_bkp] location [/var/lib/elasticsearch/es_bkp] doesn't match any of the locations specified by path.repo because this setting is empty")"

 

The reason for this issue is the setting of the wrong repo path, i.e., 
path.logs: /var/lib/elasticsearch/backups in the /etc/elasticsearch/elasticsearch.yml
.


To resolve this issue, do the following:

 

1) SSH to the FortiSOAR VM and log in as a root user.

2) Edit the /etc/elasticsearch/elasticsearch.yml file to correct the repo path. Set the repo path to: path.repo["/var/lib/elasticsearch/es_bkp"]

3) Restart the Elasticsearch service using the following command: systemctl restart elasticsearch