Github user nickwallen commented on a diff in the pull request:
https://github.com/apache/metron/pull/811#discussion_r146925677
--- Diff:
metron-platform/metron-elasticsearch/src/main/java/org/apache/metron/elasticsearch/dao/ElasticsearchMetaAlertDao.java
---
@@ -295,19 +341,199 @@ protected Document
buildCreateDocument(MultiGetResponse multiGetResponse, List<S
/**
* Process an update to a meta alert itself.
* @param update The update Document to be applied
- * @param index The optional index to update to
* @throws IOException If there's a problem running the update
*/
- protected void handleMetaUpdate(Document update, Optional<String> index)
throws IOException {
- // We have an update to a meta alert itself
- // If we've updated the alerts field (i.e add/remove), recalculate
meta alert scores.
+ protected void handleMetaUpdate(Document update) throws IOException {
--- End diff --
The problem here seems unrelated to your PR. I think the serialized JSON
is just too large with these ~500 alerts when it attempts to write them to
HBase. I think we impose a limit of 999 currently, but I'm not sure a fixed
limit is going to always work. It depends on the size of each alert.
I will create a JIRA to track this separately.
---
