Github user ottobackwards commented on the issue: https://github.com/apache/metron/pull/814 @jjmeyer0 thanks for the tests. The issue is that we call validate and then parse. When we call validate, we resolve all vars to NULL. This means that the clauses in these failures are false. As stated in the readme, something in the match must be true or you get an error. In this case, we have an issue where validate is forcing us into that condition and we don't have a default, so it is an error. I'll keep looking. If you have any thoughts, or maybe @cestella does, I'm all ears.
---