Unable to create/escalate to new case system : Code 400

[gokulsatheesh]

I am not able to create/escalate to case. i keep getting 400 error (Request failed with status code 400
) Is there any solution to the issue. I found the following in the soc logs:

timestamp=2022-10-26T09:20:10.590214805Z level=info message="Searching Elasticsearch" query="{\"query\":{\"bool\":{\"filter\":[],\"must\":[{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"_index: \\\"*:so-case\\\" AND so_kind: \\\"case\\\" AND _id: \\\"JQiXE4QBu5316Ndnj15E\\\"\"}},{\"range\":{\"@timestamp\":{\"format\":\"strict_date_optional_time\",\"gte\":\"0001-01-01T00:00:00Z\",\"lte\":\"2022-10-26T09:20:10Z\"}}}],\"must_not\":[],\"should\":[]}},\"size\":1}" requestId=5666b3a0-b515-4907-b309-2d30cc395aa5 timestamp=2022-10-26T09:20:10.670545743Z level=warn message="Request did not complete successfully" error="Object not found" requestId=5666b3a0-b515-4907-b309-2d30cc395aa5 requestor=7acab6a7-611d-4097-b88f-79bc9de0a26b timestamp=2022-10-26T09:20:10.670635442Z level=info message="Handled request" contentLength=115 elapsedMs=107 impl=*server.CaseHandler method=POST path=/api/case/ remoteAddr=172.17.0.1:42422 requestId=5666b3a0-b515-4907-b309-2d30cc395aa5 requestor=7acab6a7-611d-4097-b88f-79bc9de0a26b sourceIp=192.168.95.95 statusCode=400

found a similar discussion here #7077 but a re-installation is not feasible in my situation.can anyone provide an alternative?

[dougburks]

From #1720:

Please include the following details where you can:

• Security Onion version as seen in the lower left corner of SOC and in /etc/soversion. For example: 2.3.140
• Is this a cloud deployment or on-prem? If on-prem, do you have Internet access or this an airgap installation?
• Did you install from our Security Onion ISO image or did you perform a network installation?
• If network installation, did you install on CentOS 7 or Ubuntu?
• How many nodes do you have?
• What are the hardware specs of each of those nodes?
• How are each of those nodes configured? (ex. manager with 2 search nodes and 3 forward nodes)
• Are you experiencing issues monitoring network traffic? If so, are you sniffing from a tap or span port and what is the traffic volume?
• Does so-status show all services running?
• Do you get any failures when you run sudo salt-call state.highstate?
• Does the SOC Grid page show any failures?