Github user nickwallen commented on a diff in the pull request: https://github.com/apache/metron/pull/1218#discussion_r223513848 --- Diff: metron-platform/metron-elasticsearch/src/test/java/org/apache/metron/elasticsearch/integration/ElasticsearchSearchIntegrationTest.java --- @@ -352,6 +350,24 @@ public void different_type_filter_query() throws Exception { Assert.assertEquals("data 1", results.get(0).getSource().get("ttl")); } + @Test + public void queries_fields() throws Exception { + SearchRequest request = JSONUtils.INSTANCE.load(fieldsQuery, SearchRequest.class); + SearchResponse response = getIndexDao().search(request); + Assert.assertEquals(10, response.getTotal()); + + List<SearchResult> results = response.getResults(); + Assert.assertEquals(10, response.getResults().size()); + + // validate the source fields contained in the search response + for (int i = 0; i < 10; ++i) { + Map<String, Object> source = results.get(i).getSource(); + Assert.assertNotNull(source); + Assert.assertNotNull(source.get(Constants.Fields.SRC_ADDR.getName())); + Assert.assertNotNull(source.get(Constants.GUID)); --- End diff -- Elasticsearch must now always return the GUID to populate the UI. We cannot rely on the document ID being the same as the Metron GUID.
---