[
https://issues.apache.org/jira/browse/METRON-1289?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16250456#comment-16250456
]
ASF GitHub Bot commented on METRON-1289:
----------------------------------------
Github user merrimanr commented on the issue:
https://github.com/apache/metron/pull/824
The latest commit fixes the bug in the previous comment. The root cause
was that HBaseDao.getAllLatest was not properly returning the sensor type and
causing subsequent updates in Elasticsearch to fail. The solution was simple:
look up the sensor type from the document and add it to the return Document. I
added a constant for this field (essentially a copy of
ElasticsearchMetaAlertDao.SOURCE_TYPE) to the HBaseDao in anticipation of the
ES 5 upgrade where it will no longer be required to change .'s to :'s. At that
point we can just change the constant to Constants.SENSOR_TYPE and it should
continue to function.
There are a couple other solutions to this problem that I can think of:
- change the getAllLatest interface to include guid/sensorType mappings
instead of separate guid and sensorType lists
- add a column family to store the sensor type
- other more complicated ways of getting the correct sensor type field name
I felt this temporary constant was the simplest but feel free to give
opinions on other options. I also update the HBaseDaoIntegrationTest to expect
this field to be returned.
The PR description has been updated to reflect the various interface
changes and new testing procedure.
> Alert fields are lost when a MetaAlert is created
> -------------------------------------------------
>
> Key: METRON-1289
> URL: https://issues.apache.org/jira/browse/METRON-1289
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
> Assignee: Ryan Merriman
>
> When a MetaAlert is created, the included results are being updated
> incorrectly with only the "metaalert" field. This causes subsequent findOne
> operations to only return the "metaalert field for that alert. All fields
> should continue to be present.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
