Hi all, I just opened a PR for fixing filtering in Alerts UI. I found a few other use cases which haven't worked as expected. https://github.com/apache/metron/pull/1443
Regards, Tibor On Mon, Jun 3, 2019 at 5:13 PM Tibor Meller <tibor.mel...@gmail.com> wrote: > Thanks for the answers! > Ticket created: https://issues.apache.org/jira/browse/METRON-2150 > I start working on it bc it bocking me. > > On Fri, May 31, 2019 at 9:43 PM Michael Miklavcic < > michael.miklav...@gmail.com> wrote: > >> Can you log a Jira for this Tibor? >> >> On Fri, May 31, 2019 at 1:22 PM Otto Fowler <ottobackwa...@gmail.com> >> wrote: >> >> > Bug >> > >> > >> > On May 31, 2019 at 08:53:21, Tibor Meller (tibor.mel...@gmail.com) >> wrote: >> > >> > Hi all, >> > >> > tl;dr: Is it a bug if "* -alert_status:RESOLVE OR -alert_status:DISMISS" >> > not works on Alert UI? >> > >> > I'm experimenting with filtering from the alert UI. What I found is I >> can >> > run the following query directly against the REST API without any >> problem: >> > "* -alert_status:RESOLVE OR -alert_status:DISMISS" >> > But if I try to add the same filter on the Alert UI only the >> > alert_status:DISMISS applies to the query. >> > The reason is we identifying filters by filter.field so two filters to >> the >> > same filed (alert_status in this case) override each other. >> > >> > Is this a bug? If it is, I'm happy to fix it. >> > >> > Regards, >> > Tibor >> > >> >
