[
https://issues.apache.org/jira/browse/METRON-1272?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16215953#comment-16215953
]
ASF GitHub Bot commented on METRON-1272:
----------------------------------------
Github user nickwallen commented on the issue:
https://github.com/apache/metron/pull/811
Another thing I noticed is that there does not seem to be a way to retrieve
meta-alerts that you have created.
For example, I created a meta-alert where `host:ip-addr.es`. Assuming we
exclude metaalerts from all the nice "group by" functionality, then I need to
find it using search. But if I search with `host:ip-addr.es` or even
`alert.host.ip-addr.es` it does not return any results.
When using `alert.host` the UI submits the following which returns no
results.
```
{
"indices": [
"websphere",
"snort",
"asa",
"bro",
"yaf",
"metaalert"
],
"facetFields": [
"source:type",
"ip_src_addr",
"ip_dst_addr",
"host",
"enrichments:geo:ip_dst_addr:country"
],
"query": "(host:ip\\-addr.es OR alert.host:ip\\-addr.es)",
"from": 0,
"size": 25,
"sort": [
{
"field": "host",
"sortOrder": "asc"
}
]
}
```
I ran this by @justinleet and we found that it is the `sort` field that
prevents the meta-alerts from being returned. Removing the sort field like the
following query does actually return the meta-alert.
```
{
"indices": [
"websphere",
"snort",
"asa",
"bro",
"yaf",
"metaalert"
],
"facetFields": [
"source:type",
"ip_src_addr",
"ip_dst_addr",
"host",
"enrichments:geo:ip_dst_addr:country"
],
"query": "(host:ip\\-addr.es OR alert.host:ip\\-addr.es)",
"from": 0,
"size": 25
}
```
> Hide child alerts from searches and grouping if they belong to meta alerts
> --------------------------------------------------------------------------
>
> Key: METRON-1272
> URL: https://issues.apache.org/jira/browse/METRON-1272
> Project: Metron
> Issue Type: Improvement
> Reporter: Justin Leet
> Assignee: Justin Leet
>
> If an alert is already grouped into a meta alert, it's nice to route
> everything through the same query structure and allow sorting alongside them,
> etc. However, showing alerts that are already contained in a meta alert is
> potential clutter for a user and gives the impression an event has occurred
> twice if it's in a standalone alert and a metaalert.
> This should hide alerts contained in a meta alert from searches (which will
> always match the enclosing meta alert anyway, so nothing will be lost from
> the search).
> They should also be hidden from grouping calls, because the user has already
> manually grouped them during prior slicing and dicing.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
