[
https://issues.apache.org/jira/browse/METRON-1526?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16443072#comment-16443072
]
ASF GitHub Bot commented on METRON-1526:
----------------------------------------
Github user ottobackwards commented on the issue:
https://github.com/apache/metron/pull/995
I am thinking of the metron as a framework POV here. Right now, someone
can create a parser, an enrichment a (in this PR's world) solr/es schema for
their input.
This PR makes assumptions about a single use case, but the platform allows
the capability for this to happen in many other ways that are beyond the
control or knowledge of the 'core' platform through the platform's
extensibility.
That makes any remediation of this issue a 'one' off it assumes knowledge
of the data, which the platform cannot have beyond the parsers that ship. And
even then that knowledge ( based on the known configuration ) is not reliable
because they are examples and can be modified.
Does that make sense or am I missing something?
> Location field types cause DocValuesField appear more than once error
> ---------------------------------------------------------------------
>
> Key: METRON-1526
> URL: https://issues.apache.org/jira/browse/METRON-1526
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
> Assignee: Ryan Merriman
> Priority: Major
>
> While testing [https://github.com/apache/metron/pull/970] I get this error
> when creating a meta alert:
> {code:java}
> Error from server at http://10.0.2.15:8983/solr/bro: Exception writing
> document id bbc150f5-92f8-485d-93cc-11730c1edf31 to the index; possible
> analysis error: DocValuesField
> \"enrichments.geo.ip_dst_addr.location_point_0_coordinate\" appears more than
> once in this document (only one value is allowed per field){code}
> I tracked it down to the fact that multiple fields are returned for a
> location field. For example when a field named
> "enrichments.geo.ip_dst_addr.location_point" is configured in a schema, these
> fields are returned in a query:
> {code:java}
> {
> "enrichments.geo.ip_dst_addr.location_point_0_coordinate": "33.4499",
> "enrichments.geo.ip_dst_addr.location_point_1_coordinate": "-112.0712",
> "enrichments.geo.ip_dst_addr.location_point": "33.4499,-112.0712"
> }
> {code}
> We need a way to either suppress these extra fields when querying or remove
> them before updating a document.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
