[
https://issues.apache.org/jira/browse/METRON-1526?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16446352#comment-16446352
]
ASF GitHub Bot commented on METRON-1526:
----------------------------------------
Github user mmiklavc commented on the issue:
https://github.com/apache/metron/pull/995
```
{
"enrichments.geo.ip_dst_addr.location_point_0_coordinate": [
"34.0438",
"34.0438"
],
"enrichments.geo.ip_dst_addr.location_point_1_coordinate": [
"-118.2512",
"-118.2512"
],
"enrichments.geo.ip_dst_addr.location_point": "34.0438,-118.2512"
}
```
> That does not look correct to me.
@merrimanr - can you be more specific? I gather it should not be an array,
but simple string value for the derived fields, e.g.
```
{
"enrichments.geo.ip_dst_addr.location_point_0_coordinate":"34.0438",
"enrichments.geo.ip_dst_addr.location_point_1_coordinate":"-118.2512",
"enrichments.geo.ip_dst_addr.location_point": "34.0438,-118.2512"
}
```
What was your input doc when doing this test on 5.5? Did you included the
expanded fields as part of the insert? To me your results make it look like
Solr treated the values as an additive operation vs overwrite, but it's hard
for me to say without more detail.
> Location field types cause DocValuesField appear more than once error
> ---------------------------------------------------------------------
>
> Key: METRON-1526
> URL: https://issues.apache.org/jira/browse/METRON-1526
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
> Assignee: Ryan Merriman
> Priority: Major
>
> While testing [https://github.com/apache/metron/pull/970] I get this error
> when creating a meta alert:
> {code:java}
> Error from server at http://10.0.2.15:8983/solr/bro: Exception writing
> document id bbc150f5-92f8-485d-93cc-11730c1edf31 to the index; possible
> analysis error: DocValuesField
> \"enrichments.geo.ip_dst_addr.location_point_0_coordinate\" appears more than
> once in this document (only one value is allowed per field){code}
> I tracked it down to the fact that multiple fields are returned for a
> location field. For example when a field named
> "enrichments.geo.ip_dst_addr.location_point" is configured in a schema, these
> fields are returned in a query:
> {code:java}
> {
> "enrichments.geo.ip_dst_addr.location_point_0_coordinate": "33.4499",
> "enrichments.geo.ip_dst_addr.location_point_1_coordinate": "-112.0712",
> "enrichments.geo.ip_dst_addr.location_point": "33.4499,-112.0712"
> }
> {code}
> We need a way to either suppress these extra fields when querying or remove
> them before updating a document.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
