Github user justinleet commented on a diff in the pull request:
https://github.com/apache/metron/pull/788#discussion_r143161957
--- Diff:
metron-interface/metron-alerts/src/app/alerts/alert-details/alert-details.component.ts
---
@@ -133,6 +173,40 @@ export class AlertDetailsComponent implements OnInit {
});
}
+ onAddComment() {
+ let alertComment = new AlertComment(this.alertCommentStr,
this.authenticationService.getCurrentUserName(), new Date().getTime());
+ let tAlertComments = this.alertCommentsWrapper.map(alertsWrapper =>
alertsWrapper.alertComment);
+ tAlertComments.unshift(alertComment);
+ this.patchAlert(new Patch('add', '/comments', tAlertComments));
+ }
+
+ patchAlert(patch: Patch) {
+ let patchRequest = new PatchRequest();
+ patchRequest.guid = this.alertSource.guid;
+ patchRequest.index = this.alertIndex;
+ patchRequest.patch = [patch];
+ patchRequest.sensorType = this.alertSourceType;
+
+ this.updateService.patch(patchRequest).subscribe(() => {
+ this.getData();
+ });
+ }
+
+ onDeleteComment(index: number) {
+ let commentText = 'Do you wish to delete the comment ';
+ if (this.alertCommentsWrapper[index].alertComment.comment.length > 25
) {
+ commentText += ' \'' +
this.alertCommentsWrapper[index].alertComment.comment.substr(0, 25) + '...\'';
+ } else {
+ commentText += ' \'' +
this.alertCommentsWrapper[index].alertComment.comment + '\'';
+ }
+
+
this.metronDialogBox.showConfirmationMessage(commentText).subscribe(response =>
{
+ if (response) {
+ this.alertCommentsWrapper.splice(index, 1);
+ this.patchAlert(new Patch('add', '/comments',
this.alertCommentsWrapper.map(alertsWrapper => alertsWrapper.alertComment)));
--- End diff --
@simonellistonball I think an `"index" : "no"` field would work? I think?
I think that still involves mapping updates since that's not the default
and would need to be on every sensor (or we'll end up with analyzed or raw or
whatever the default is fields). Which loops back around to backend changes. My
concern with not doing a more complete solution is you'd have to reindex
anything with a non null comments field, which is potentially a pain (and I
don't know how much work that is, so it's also possible it's not at all a pain).
Using the meta alert coping mechanisms is still backend change, though.
That primarily gets handled by the DAOs.
---
