(Dashboards) Coordinate maps return HTTP 500 on upgraded instances after the origin.ip bucket fix #2893

Acknowledgements

• I have searched (https://github.com/utmstack/UTMStack/issues) for past instances of this issue
• I have verified that my UTMStack version is up-to-date

Describe the bug

After upgrading to v11.3.0, the coordinate-map visualizations changed by changeset 20261012003_fix_map_coordinate_fields (ids 127, 522, 55, 573, 532, 510) fail with HTTP 500 when the time range includes indices created before the upgrade. Example: "O365 AD Successful Login Location" (id 55). The fix works on fresh installs only.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

The map renders points for both pre-upgrade and post-upgrade data, or at least does not fail.

Current Behavior

POST /api/utm-visualizations/run
{"id":55,"name":"O365 AD Successful Login Location","chartType":"COORDINATE_MAP_CHART",
"aggregationType":{"bucket":{"aggregation":"TERMS","field":"origin.ip",...}},
"filterType":[{"field":"@timestamp","operator":"IS_BETWEEN","value":["now-30d","now"]}, ...],
"pattern":{"pattern":"v11-log-o365-*"}, ...}

HTTP 500 (empty body; message only in the failure-alert response header)
UtmVisualizationResource.run: ElasticsearchService.search: OpenSearch.search:
Request failed: [search_phase_execution_exception] all shards failed

Verified on an upgraded dev instance by re-sending the same /run request with different bucket fields and ranges:

Even post-upgrade data still has origin.ip mapped as text, so on this instance the change breaks the map for all data, not only pre-upgrade data. Cause: the v11.3.0 mapping templates were not created on upgrade (only utmstack_indexes exists); see the related installer issue "v11.3.0 OpenSearch index templates are not created on upgrade".

Reproduction Steps

1. Upgrade an instance with existing O365 data from v11.2.16 to v11.3.0.
2. Open a dashboard with "O365 AD Successful Login Location" (or any of the 6 maps), time range covering pre-upgrade days.
3. Observe HTTP 500 on /api/utm-visualizations/run and an empty map.
4. In the chart builder, change the bucket field to origin.ip.keyword → the map renders pre-upgrade points.

Possible Solution

Root cause: the type of origin.ip differs between old and new indices.

v11.2.16 installed no index mapping (installer/services/search.go only set index settings), so origin.ip was dynamically mapped as text + keyword sub-field.
v11.3.0 maps origin.ip as ip for new indices.
Changeset 20261012003 switched the bucket from origin.ip.keyword to origin.ip. A terms aggregation on a text field fails (fielddata disabled), so any pre-upgrade index in the range makes the whole search fail.

Additional Information/Context

No response

UTMStack Version

v11.3.0-community (upgraded from v11.2.16)

Operating System and version

Ubuntu 24.04.4 LTS

Hypervisor and Version | Server Vendor and Model

Browser and version

Chrome 154.0.8037.98 (Official Build) (arm64), macOS