Github user justinleet commented on the issue:
https://github.com/apache/metron/pull/824
I've spun this up, and `add/alert` throws this exception:
```
{
"responseCode": 500,
"message": "class org.apache.metron.elasticsearch.dao.ElasticsearchDao:
ElasticsearchDao upsert failed: failure in bulk execution:
[1]: index [metaalert_index], type [null_doc], id
[be44748e-6471-465f-bd08-7f2c164b6755], message
[java.lang.IllegalArgumentException: object mapping [alert] can't be changed
from nested to non-nested]
java.io.IOException: ElasticsearchDao upsert failed: failure in bulk
execution:
[1]: index [metaalert_index], type [null_doc], id
[be44748e-6471-465f-bd08-7f2c164b6755], message
[java.lang.IllegalArgumentException: object mapping [alert] can't be changed
from nested to non-nested]
at
org.apache.metron.elasticsearch.dao.ElasticsearchDao.batchUpdate(ElasticsearchDao.java:368)
at
org.apache.metron.indexing.dao.MultiIndexDao.lambda$batchUpdate$3(MultiIndexDao.java:79)
at
java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193)
at
java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1374)
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)
at
java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)
at java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:747)
at java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:721)
at java.util.stream.AbstractTask.compute(AbstractTask.java:316)
at java.util.concurrent.CountedCompleter.exec(CountedCompleter.java:731)
at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
at
java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
at
java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)
",
"fullMessage": "IOException: class
org.apache.metron.elasticsearch.dao.ElasticsearchDao: ElasticsearchDao upsert
failed: failure in bulk execution:
[1]: index [metaalert_index], type [null_doc], id
[be44748e-6471-465f-bd08-7f2c164b6755], message
[java.lang.IllegalArgumentException: object mapping [alert] can't be changed
from nested to non-nested]
java.io.IOException: ElasticsearchDao upsert failed: failure in bulk
execution:
[1]: index [metaalert_index], type [null_doc], id
[be44748e-6471-465f-bd08-7f2c164b6755], message
[java.lang.IllegalArgumentException: object mapping [alert] can't be changed
from nested to non-nested]
at
org.apache.metron.elasticsearch.dao.ElasticsearchDao.batchUpdate(ElasticsearchDao.java:368)
at
org.apache.metron.indexing.dao.MultiIndexDao.lambda$batchUpdate$3(MultiIndexDao.java:79)
at
java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193)
at
java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1374)
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)
at
java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)
at java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:747)
at java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:721)
at java.util.stream.AbstractTask.compute(AbstractTask.java:316)
at java.util.concurrent.CountedCompleter.exec(CountedCompleter.java:731)
at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)
at
java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)
at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692)
at
java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)
"
}
```
Request
```
{
"alertGuids": [
"9b2e9b29-41a5-45fc-aabe-fd49c63af943",
"0fbea2b2-c4f3-43a8-a717-8ceb3467ae10",
"698289ca-43cf-4add-bf35-2a391ae1c244"
],
"metaAlertGuid": "be44748e-6471-465f-bd08-7f2c164b6755",
"sensorTypes": [
"bro"
]
}
```
I'll dig into it a bit, but I assume something isn't quite being
constructed properly.
---
