Ryan Merriman created METRON-1526:

             Summary: Location field types cause DocValuesField appear more 
than once error
                 Key: METRON-1526
                 URL: https://issues.apache.org/jira/browse/METRON-1526
             Project: Metron
          Issue Type: Bug
            Reporter: Ryan Merriman
            Assignee: Ryan Merriman

While testing [https://github.com/apache/metron/pull/970] I get this error when 
creating a meta alert:
Error from server at Exception writing document 
id bbc150f5-92f8-485d-93cc-11730c1edf31 to the index; possible analysis error: 
DocValuesField \"enrichments.geo.ip_dst_addr.location_point_0_coordinate\" 
appears more than once in this document (only one value is allowed per 
I tracked it down to the fact that multiple fields are returned for a location 
field.  For example when a field named 
"enrichments.geo.ip_dst_addr.location_point" is configured in a schema, these 
fields are returned in a query:
"enrichments.geo.ip_dst_addr.location_point_0_coordinate": "33.4499",
"enrichments.geo.ip_dst_addr.location_point_1_coordinate": "-112.0712",
"enrichments.geo.ip_dst_addr.location_point": "33.4499,-112.0712"

 We need a way to either suppress these extra fields when querying or remove 
them before updating a document. 

This message was sent by Atlassian JIRA

Reply via email to