Github user merrimanr commented on the issue:
https://github.com/apache/metron/pull/970
I spun this up in full dev and can't quite get it to work. In the first
test I am trying to create and modify a metaalert directly through Swagger.
After switching the search engine to Solr and indexing data into Solr
collections I run a search in Swagger to get a couple guids. Once I have those
I try to create a metaalert through the
http://node1:8082/swagger-ui.html#!/meta-alert-controller/createUsingPOST
endpoint. Here is the request:
```
{
"alerts": [
{
"guid": "0ce62f0e-12cd-4dd7-994b-cd1f7220d9ec",
"index": "bro",
"sensorType": "bro"
},
{
"guid": "f425aa12-5a36-4461-917c-a61f47d9781e",
"index": "bro",
"sensorType": "bro"
}
],
"groups": [
"group"
]
}
```
Then I get this error response:
```
{
"responseCode": 500,
"message": "Unable to create meta alert",
"fullMessage": "IOException: class org.apache.metron.solr.dao.SolrDao:
Error from server at http://10.0.2.15:8983/solr/metaalert: ERROR:
[doc=8cf24075-520b-440d-8ae3-f63481a1660c] multiple values encountered for non
multiValued field _childDocuments_:
[{adapter.threatinteladapter.end.ts=1522100275770,
bro_timestamp=1522100274.971272, ip_dst_port=8080,
enrichmentsplitterbolt.splitter.end.ts=1522100275760,
enrichmentsplitterbolt.splitter.begin.ts=1522100275760,
adapter.hostfromjsonlistadapter.end.ts=1522100275763,
adapter.geoadapter.begin.ts=1522100275763, uid=CUrRne3iLIxXavQtci,
trans_depth=77, protocol=http, original_string=HTTP | id.orig_p:50451
method:GET request_body_len:0 id.resp_p:8080
uri:/api/v1/clusters/metron_cluster/components/?ServiceComponentInfo/component_name=APP_TIMELINE_SERVER|ServiceComponentInfo/category=MASTER&fields=ServiceComponentInfo/service_name,host_components/HostRoles/display_name,host_components/HostRoles/host_name,host_components/HostRoles/state,hos
t_components/HostRoles/maintenance_state,host_components/HostRoles/stale_configs,host_components/HostRoles/ha_state,host_components/HostRoles/desired_admin_state,,host_components/metrics/jvm/memHeapUsedM,host_components/metrics/jvm/HeapMemoryMax,host_components/metrics/jvm/HeapMemoryUsed,host_components/metrics/jvm/memHeapCommittedM,host_components/metrics/mapred/jobtracker/trackers_decommissioned,host_components/metrics/cpu/cpu_wio,host_components/metrics/rpc/client/RpcQueueTime_avg_time,host_components/metrics/dfs/FSNamesystem/*,host_components/metrics/dfs/namenode/Version,host_components/metrics/dfs/namenode/LiveNodes,host_components/metrics/dfs/namenode/DeadNodes,host_components/metrics/dfs/namenode/DecomNodes,host_components/metrics/dfs/namenode/TotalFiles,host_components/metrics/dfs/namenode/UpgradeFinalized,host_components/metrics/dfs/namenode/Safemode,host_components/metrics/runtime/StartTime,host_components/metrics/hbase/master/IsActiveMaster,host_components/metrics/hbase/m
aster/MasterStartTime,host_components/metrics/hbase/master/MasterActiveTime,host_components/metrics/hbase/master/AverageLoad,host_components/metrics/master/AssignmentManger/ritCount,metrics/api/v1/cluster/summary,metrics/api/v1/topology/summary,metrics/api/v1/nimbus/summary,host_components/metrics/yarn/Queue,host_components/metrics/yarn/ClusterMetrics/NumActiveNMs,host_components/metrics/yarn/ClusterMetrics/NumLostNMs,host_components/metrics/yarn/ClusterMetrics/NumUnhealthyNMs,host_components/metrics/yarn/ClusterMetrics/NumRebootedNMs,host_components/metrics/yarn/ClusterMetrics/NumDecommissionedNMs&minimal_response=true&_=1484168590350
tags:[] uid:CUrRne3iLIxXavQtci referrer:http://node1:8080/ trans_depth:77
host:node1 id.orig_h:192.168.66.1 response_body_len:0 user_agent:Mozilla/5.0
(Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/55.0.2883.95 Safari/537.36 ts:1522100274.971272
id.resp_h:192.168.66.121, ip_dst_addr=192.168.66.121, threatinteljoinbol
t.joiner.ts=1522100275773, host=node1,
enrichmentjoinbolt.joiner.ts=1522100275765,
adapter.hostfromjsonlistadapter.begin.ts=1522100275763,
threatintelsplitterbolt.splitter.begin.ts=1522100275767,
ip_src_addr=192.168.66.1, user_agent=Mozilla/5.0 (Macintosh; Intel Mac OS X
10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95
Safari/537.36, timestamp=1522100274971, method=GET, request_body_len=0,
uri=/api/v1/clusters/metron_cluster/components/?ServiceComponentInfo/component_name=APP_TIMELINE_SERVER|ServiceComponentInfo/category=MASTER&fields=ServiceComponentInfo/service_name,host_components/HostRoles/display_name,host_components/HostRoles/host_name,host_components/HostRoles/state,host_components/HostRoles/maintenance_state,host_components/HostRoles/stale_configs,host_components/HostRoles/ha_state,host_components/HostRoles/desired_admin_state,,host_components/metrics/jvm/memHeapUsedM,host_components/metrics/jvm/HeapMemoryMax,host_components/metrics/jvm/HeapMemoryUsed,host
_components/metrics/jvm/memHeapCommittedM,host_components/metrics/mapred/jobtracker/trackers_decommissioned,host_components/metrics/cpu/cpu_wio,host_components/metrics/rpc/client/RpcQueueTime_avg_time,host_components/metrics/dfs/FSNamesystem/*,host_components/metrics/dfs/namenode/Version,host_components/metrics/dfs/namenode/LiveNodes,host_components/metrics/dfs/namenode/DeadNodes,host_components/metrics/dfs/namenode/DecomNodes,host_components/metrics/dfs/namenode/TotalFiles,host_components/metrics/dfs/namenode/UpgradeFinalized,host_components/metrics/dfs/namenode/Safemode,host_components/metrics/runtime/StartTime,host_components/metrics/hbase/master/IsActiveMaster,host_components/metrics/hbase/master/MasterStartTime,host_components/metrics/hbase/master/MasterActiveTime,host_components/metrics/hbase/master/AverageLoad,host_components/metrics/master/AssignmentManger/ritCount,metrics/api/v1/cluster/summary,metrics/api/v1/topology/summary,metrics/api/v1/nimbus/summary,host_components/me
trics/yarn/Queue,host_components/metrics/yarn/ClusterMetrics/NumActiveNMs,host_components/metrics/yarn/ClusterMetrics/NumLostNMs,host_components/metrics/yarn/ClusterMetrics/NumUnhealthyNMs,host_components/metrics/yarn/ClusterMetrics/NumRebootedNMs,host_components/metrics/yarn/ClusterMetrics/NumDecommissionedNMs&minimal_response=true&_=1484168590350,
metaalerts=[8cf24075-520b-440d-8ae3-f63481a1660c], source.type=bro,
adapter.geoadapter.end.ts=1522100275763, referrer=http://node1:8080/,
threatintelsplitterbolt.splitter.end.ts=1522100275767,
adapter.threatinteladapter.begin.ts=1522100275770, ip_src_port=50451,
guid=0ce62f0e-12cd-4dd7-994b-cd1f7220d9ec, response_body_len=0},
{adapter.threatinteladapter.end.ts=1522100275769,
bro_timestamp=1522100274.955487, status_code=200, ip_dst_port=80,
enrichmentsplitterbolt.splitter.end.ts=1522100275758,
enrichments.geo.ip_dst_addr.latitude=55.7386,
enrichments.geo.ip_dst_addr.location_point_0_coordinate=55.7386,
enrichmentsplitterbolt.splitter.begi
n.ts=1522100275758, adapter.hostfromjsonlistadapter.end.ts=1522100275760,
enrichments.geo.ip_dst_addr.country=RU,
adapter.geoadapter.begin.ts=1522100275761, uid=CA0G2ASkF1efFirs7,
resp_mime_types=[image/png], trans_depth=3, protocol=http, original_string=HTTP
| id.orig_p:49210 status_code:200 method:GET request_body_len:0 id.resp_p:80
uri:/img/button_pay.png tags:[] uid:CA0G2ASkF1efFirs7
referrer:http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg
resp_mime_types:[\"image\\/png\"] trans_depth:3
host:7oqnsnzwwnm6zb7y.gigapaysun.com status_msg:OK id.orig_h:192.168.138.158
response_body_len:727 user_agent:Mozilla/4.0 (compatible; MSIE 8.0; Windows NT
6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET
CLR 3.0.30729; Media Center PC 6.0) ts:1522100274.955487
id.resp_h:95.163.121.204 resp_fuids:[\"F7c5Lp3iMksOUQHIbl\"],
ip_dst_addr=95.163.121.204, threatinteljoinbolt.joiner.ts=1522100275772,
host=7oqnsnzwwnm6zb7y.gigapaysun.com, enrichmentjoinbolt.joiner.ts=1522100275
763, adapter.hostfromjsonlistadapter.begin.ts=1522100275760,
threatintelsplitterbolt.splitter.begin.ts=1522100275766,
enrichments.geo.ip_dst_addr.longitude=37.6068, ip_src_addr=192.168.138.158,
user_agent=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64;
Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;
Media Center PC 6.0), resp_fuids=[F7c5Lp3iMksOUQHIbl], timestamp=1522100274955,
method=GET, request_body_len=0, uri=/img/button_pay.png,
metaalerts=[8cf24075-520b-440d-8ae3-f63481a1660c], source.type=bro,
adapter.geoadapter.end.ts=1522100275761,
referrer=http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg,
threatintelsplitterbolt.splitter.end.ts=1522100275766,
adapter.threatinteladapter.begin.ts=1522100275769, ip_src_port=49210,
enrichments.geo.ip_dst_addr.location_point_1_coordinate=37.6068,
enrichments.geo.ip_dst_addr.location_point=55.7386,37.6068, status_msg=OK,
guid=f425aa12-5a36-4461-917c-a61f47d9781e,
response_body_len=727}]\norg.apache.solr.cl
ient.solrj.impl.HttpSolrClient$RemoteSolrException: Error from server at
http://10.0.2.15:8983/solr/metaalert: ERROR:
[doc=8cf24075-520b-440d-8ae3-f63481a1660c] multiple values encountered for non
multiValued field _childDocuments_:
[{adapter.threatinteladapter.end.ts=1522100275770,
bro_timestamp=1522100274.971272, ip_dst_port=8080,
enrichmentsplitterbolt.splitter.end.ts=1522100275760,
enrichmentsplitterbolt.splitter.begin.ts=1522100275760,
adapter.hostfromjsonlistadapter.end.ts=1522100275763,
adapter.geoadapter.begin.ts=1522100275763, uid=CUrRne3iLIxXavQtci,
trans_depth=77, protocol=http, original_string=HTTP | id.orig_p:50451
method:GET request_body_len:0 id.resp_p:8080
uri:/api/v1/clusters/metron_cluster/components/?ServiceComponentInfo/component_name=APP_TIMELINE_SERVER|ServiceComponentInfo/category=MASTER&fields=ServiceComponentInfo/service_name,host_components/HostRoles/display_name,host_components/HostRoles/host_name,host_components/HostRoles/state,host_components/HostRoles/m
aintenance_state,host_components/HostRoles/stale_configs,host_components/HostRoles/ha_state,host_components/HostRoles/desired_admin_state,,host_components/metrics/jvm/memHeapUsedM,host_components/metrics/jvm/HeapMemoryMax,host_components/metrics/jvm/HeapMemoryUsed,host_components/metrics/jvm/memHeapCommittedM,host_components/metrics/mapred/jobtracker/trackers_decommissioned,host_components/metrics/cpu/cpu_wio,host_components/metrics/rpc/client/RpcQueueTime_avg_time,host_components/metrics/dfs/FSNamesystem/*,host_components/metrics/dfs/namenode/Version,host_components/metrics/dfs/namenode/LiveNodes,host_components/metrics/dfs/namenode/DeadNodes,host_components/metrics/dfs/namenode/DecomNodes,host_components/metrics/dfs/namenode/TotalFiles,host_components/metrics/dfs/namenode/UpgradeFinalized,host_components/metrics/dfs/namenode/Safemode,host_components/metrics/runtime/StartTime,host_components/metrics/hbase/master/IsActiveMaster,host_components/metrics/hbase/master/MasterStartTime,ho
st_components/metrics/hbase/master/MasterActiveTime,host_components/metrics/hbase/master/AverageLoad,host_components/metrics/master/AssignmentManger/ritCount,metrics/api/v1/cluster/summary,metrics/api/v1/topology/summary,metrics/api/v1/nimbus/summary,host_components/metrics/yarn/Queue,host_components/metrics/yarn/ClusterMetrics/NumActiveNMs,host_components/metrics/yarn/ClusterMetrics/NumLostNMs,host_components/metrics/yarn/ClusterMetrics/NumUnhealthyNMs,host_components/metrics/yarn/ClusterMetrics/NumRebootedNMs,host_components/metrics/yarn/ClusterMetrics/NumDecommissionedNMs&minimal_response=true&_=1484168590350
tags:[] uid:CUrRne3iLIxXavQtci referrer:http://node1:8080/ trans_depth:77
host:node1 id.orig_h:192.168.66.1 response_body_len:0 user_agent:Mozilla/5.0
(Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/55.0.2883.95 Safari/537.36 ts:1522100274.971272
id.resp_h:192.168.66.121, ip_dst_addr=192.168.66.121,
threatinteljoinbolt.joiner.ts=152210027577
3, host=node1, enrichmentjoinbolt.joiner.ts=1522100275765,
adapter.hostfromjsonlistadapter.begin.ts=1522100275763,
threatintelsplitterbolt.splitter.begin.ts=1522100275767,
ip_src_addr=192.168.66.1, user_agent=Mozilla/5.0 (Macintosh; Intel Mac OS X
10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95
Safari/537.36, timestamp=1522100274971, method=GET, request_body_len=0,
uri=/api/v1/clusters/metron_cluster/components/?ServiceComponentInfo/component_name=APP_TIMELINE_SERVER|ServiceComponentInfo/category=MASTER&fields=ServiceComponentInfo/service_name,host_components/HostRoles/display_name,host_components/HostRoles/host_name,host_components/HostRoles/state,host_components/HostRoles/maintenance_state,host_components/HostRoles/stale_configs,host_components/HostRoles/ha_state,host_components/HostRoles/desired_admin_state,,host_components/metrics/jvm/memHeapUsedM,host_components/metrics/jvm/HeapMemoryMax,host_components/metrics/jvm/HeapMemoryUsed,host_components/metrics/jvm/
memHeapCommittedM,host_components/metrics/mapred/jobtracker/trackers_decommissioned,host_components/metrics/cpu/cpu_wio,host_components/metrics/rpc/client/RpcQueueTime_avg_time,host_components/metrics/dfs/FSNamesystem/*,host_components/metrics/dfs/namenode/Version,host_components/metrics/dfs/namenode/LiveNodes,host_components/metrics/dfs/namenode/DeadNodes,host_components/metrics/dfs/namenode/DecomNodes,host_components/metrics/dfs/namenode/TotalFiles,host_components/metrics/dfs/namenode/UpgradeFinalized,host_components/metrics/dfs/namenode/Safemode,host_components/metrics/runtime/StartTime,host_components/metrics/hbase/master/IsActiveMaster,host_components/metrics/hbase/master/MasterStartTime,host_components/metrics/hbase/master/MasterActiveTime,host_components/metrics/hbase/master/AverageLoad,host_components/metrics/master/AssignmentManger/ritCount,metrics/api/v1/cluster/summary,metrics/api/v1/topology/summary,metrics/api/v1/nimbus/summary,host_components/metrics/yarn/Queue,host_co
mponents/metrics/yarn/ClusterMetrics/NumActiveNMs,host_components/metrics/yarn/ClusterMetrics/NumLostNMs,host_components/metrics/yarn/ClusterMetrics/NumUnhealthyNMs,host_components/metrics/yarn/ClusterMetrics/NumRebootedNMs,host_components/metrics/yarn/ClusterMetrics/NumDecommissionedNMs&minimal_response=true&_=1484168590350,
metaalerts=[8cf24075-520b-440d-8ae3-f63481a1660c], source.type=bro,
adapter.geoadapter.end.ts=1522100275763, referrer=http://node1:8080/,
threatintelsplitterbolt.splitter.end.ts=1522100275767,
adapter.threatinteladapter.begin.ts=1522100275770, ip_src_port=50451,
guid=0ce62f0e-12cd-4dd7-994b-cd1f7220d9ec, response_body_len=0},
{adapter.threatinteladapter.end.ts=1522100275769,
bro_timestamp=1522100274.955487, status_code=200, ip_dst_port=80,
enrichmentsplitterbolt.splitter.end.ts=1522100275758,
enrichments.geo.ip_dst_addr.latitude=55.7386,
enrichments.geo.ip_dst_addr.location_point_0_coordinate=55.7386,
enrichmentsplitterbolt.splitter.begin.ts=1522100275758, adap
ter.hostfromjsonlistadapter.end.ts=1522100275760,
enrichments.geo.ip_dst_addr.country=RU,
adapter.geoadapter.begin.ts=1522100275761, uid=CA0G2ASkF1efFirs7,
resp_mime_types=[image/png], trans_depth=3, protocol=http, original_string=HTTP
| id.orig_p:49210 status_code:200 method:GET request_body_len:0 id.resp_p:80
uri:/img/button_pay.png tags:[] uid:CA0G2ASkF1efFirs7
referrer:http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg
resp_mime_types:[\"image\\/png\"] trans_depth:3
host:7oqnsnzwwnm6zb7y.gigapaysun.com status_msg:OK id.orig_h:192.168.138.158
response_body_len:727 user_agent:Mozilla/4.0 (compatible; MSIE 8.0; Windows NT
6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET
CLR 3.0.30729; Media Center PC 6.0) ts:1522100274.955487
id.resp_h:95.163.121.204 resp_fuids:[\"F7c5Lp3iMksOUQHIbl\"],
ip_dst_addr=95.163.121.204, threatinteljoinbolt.joiner.ts=1522100275772,
host=7oqnsnzwwnm6zb7y.gigapaysun.com,
enrichmentjoinbolt.joiner.ts=1522100275763, adapter.hostfromjso
nlistadapter.begin.ts=1522100275760,
threatintelsplitterbolt.splitter.begin.ts=1522100275766,
enrichments.geo.ip_dst_addr.longitude=37.6068, ip_src_addr=192.168.138.158,
user_agent=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64;
Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;
Media Center PC 6.0), resp_fuids=[F7c5Lp3iMksOUQHIbl], timestamp=1522100274955,
method=GET, request_body_len=0, uri=/img/button_pay.png,
metaalerts=[8cf24075-520b-440d-8ae3-f63481a1660c], source.type=bro,
adapter.geoadapter.end.ts=1522100275761,
referrer=http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg,
threatintelsplitterbolt.splitter.end.ts=1522100275766,
adapter.threatinteladapter.begin.ts=1522100275769, ip_src_port=49210,
enrichments.geo.ip_dst_addr.location_point_1_coordinate=37.6068,
enrichments.geo.ip_dst_addr.location_point=55.7386,37.6068, status_msg=OK,
guid=f425aa12-5a36-4461-917c-a61f47d9781e, response_body_len=727}]\n\tat
org.apache.solr.client.solrj.impl.Htt
pSolrClient.executeMethod(HttpSolrClient.java:612)\n\tat
org.apache.solr.client.solrj.impl.HttpSolrClient.request(HttpSolrClient.java:279)\n\tat
org.apache.solr.client.solrj.impl.HttpSolrClient.request(HttpSolrClient.java:268)\n\tat
org.apache.solr.client.solrj.impl.LBHttpSolrClient.doRequest(LBHttpSolrClient.java:447)\n\tat
org.apache.solr.client.solrj.impl.LBHttpSolrClient.request(LBHttpSolrClient.java:388)\n\tat
org.apache.solr.client.solrj.impl.CloudSolrClient.sendRequest(CloudSolrClient.java:1383)\n\tat
org.apache.solr.client.solrj.impl.CloudSolrClient.requestWithRetryOnStaleState(CloudSolrClient.java:1134)\n\tat
org.apache.solr.client.solrj.impl.CloudSolrClient.request(CloudSolrClient.java:1073)\n\tat
org.apache.solr.client.solrj.SolrRequest.process(SolrRequest.java:160)\n\tat
org.apache.solr.client.solrj.SolrClient.add(SolrClient.java:106)\n\tat
org.apache.solr.client.solrj.SolrClient.add(SolrClient.java:71)\n\tat
org.apache.metron.solr.dao.SolrUpdateDao.batchUpdate(SolrUpdat
eDao.java:87)\n\tat
org.apache.metron.solr.dao.SolrDao.batchUpdate(SolrDao.java:118)\n\tat
org.apache.metron.indexing.dao.MultiIndexDao.lambda$batchUpdate$3(MultiIndexDao.java:79)\n\tat
java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193)\n\tat
java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1374)\n\tat
java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)\n\tat
java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)\n\tat
java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:747)\n\tat
java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:721)\n\tat
java.util.stream.AbstractTask.compute(AbstractTask.java:316)\n\tat
java.util.concurrent.CountedCompleter.exec(CountedCompleter.java:731)\n\tat
java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)\n\tat
java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056)\n\tat
java.util.concurrent.ForkJoinPool.runWorker(ForkJo
inPool.java:1692)\n\tat
java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:157)\n\nclass
org.apache.metron.indexing.dao.HBaseDao: Guid and sensor type must not be
null: guid = f425aa12-5a36-4461-917c-a61f47d9781e, sensorType =
null\njava.lang.IllegalStateException: Guid and sensor type must not be null:
guid = f425aa12-5a36-4461-917c-a61f47d9781e, sensorType = null\n\tat
org.apache.metron.indexing.dao.HBaseDao$Key.toBytes(HBaseDao.java:98)\n\tat
org.apache.metron.indexing.dao.HBaseDao$Key.toBytes(HBaseDao.java:110)\n\tat
org.apache.metron.indexing.dao.HBaseDao.buildPut(HBaseDao.java:252)\n\tat
org.apache.metron.indexing.dao.HBaseDao.batchUpdate(HBaseDao.java:237)\n\tat
org.apache.metron.indexing.dao.MultiIndexDao.lambda$batchUpdate$3(MultiIndexDao.java:79)\n\tat
java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193)\n\tat
java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1374)\n\tat
java.util.stream.AbstractPipeline.copy
Into(AbstractPipeline.java:481)\n\tat
java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)\n\tat
java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:747)\n\tat
java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:721)\n\tat
java.util.stream.AbstractTask.compute(AbstractTask.java:316)\n\tat
java.util.concurrent.CountedCompleter.exec(CountedCompleter.java:731)\n\tat
java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289)\n\tat
java.util.concurrent.ForkJoinTask.doInvoke(ForkJoinTask.java:401)\n\tat
java.util.concurrent.ForkJoinTask.invoke(ForkJoinTask.java:734)\n\tat
java.util.stream.ReduceOps$ReduceOp.evaluateParallel(ReduceOps.java:714)\n\tat
java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:233)\n\tat
java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499)\n\tat
org.apache.metron.indexing.dao.MultiIndexDao.batchUpdate(MultiIndexDao.java:84)\n\tat
org.apache.metron.indexing.dao.AbstractMetaAlertDao.indexDaoU
pdate(AbstractMetaAlertDao.java:273)\n\tat
org.apache.metron.solr.dao.SolrMetaAlertDao.createMetaAlert(SolrMetaAlertDao.java:278)\n\tat
org.apache.metron.rest.service.impl.MetaAlertServiceImpl.create(MetaAlertServiceImpl.java:55)\n\tat
org.apache.metron.rest.controller.MetaAlertController.create(MetaAlertController.java:67)\n\tat
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\n\tat
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)\n\tat
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n\tat
java.lang.reflect.Method.invoke(Method.java:498)\n\tat
org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221)\n\tat
org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136)\n\tat
org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:114)\
n\tat
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)\n\tat
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)\n\tat
org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)\n\tat
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963)\n\tat
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:897)\n\tat
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)\n\tat
org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)\n\tat
javax.servlet.http.HttpServlet.service(HttpServlet.java:648)\n\tat
org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)\n\tat
javax.servlet.http.HttpServlet.service(HttpSe
rvlet.java:729)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230)\n\tat
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\n\tat
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)\n\tat
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317)\n\tat
org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)\n\tat
org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.secur
ity.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:115)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.savedrequest.RequestCacheAware
Filter.doFilter(RequestCacheAwareFilter.java:63)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:215)\n\tat
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:121)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)\n\tat
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFil
terChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)\n\tat
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n\tat
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\n\tat
org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)\n\tat
org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)\n\tat
org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)\n\tat
org.springframework.web.filter.DelegatingFi
lterProxy.doFilter(DelegatingFilterProxy.java:262)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)\n\tat
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\n\tat
org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)\n\tat
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)\n\tat
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\n\tat
org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:89)\n\tat
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)\n\tat
org.apache.catalina.co
re.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\n\tat
org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77)\n\tat
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)\n\tat
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\n\tat
org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)\n\tat
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)\n\tat
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\n\tat
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)\n\tat
org.apache.catal
ina.core.StandardContextValve.invoke(StandardContextValve.java:108)\n\tat
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)\n\tat
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)\n\tat
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)\n\tat
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)\n\tat
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349)\n\tat
org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:784)\n\tat
org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)\n\tat
org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:802)\n\tat
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1410)\n\tat
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\n\tat
java.util.concurrent.ThreadPoolExecutor.runWorker(Thread
PoolExecutor.java:1142)\n\tat
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\n\tat
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tat
java.lang.Thread.run(Thread.java:745)\n"
}
```
I also tried testing this from the Alerts UI. After grouping a couple
alerts together and trying to create a metaalert, this request is sent to REST:
```
{
"alerts": [
{
"guid": "f823d536-09c9-4eed-a50a-0a786a30c401",
"sensorType": null,
"index": null
},
{
"guid": "3090f2a1-f8b4-44c3-9bd4-5e23584f94ca",
"sensorType": null,
"index": null
},
{
"guid": "94050674-4b4c-425a-90b6-f9e48cb92206",
"sensorType": null,
"index": null
}
],
"groups": [
"ip_dst_addr"
]
}
```
Notice the null value for the sensorType and index. Not sure if this was
some kind of regression that happened before this PR or not. After fixing
those fields and sending the request again through Swagger, I get the same 500
error above.
---
