[
https://issues.apache.org/jira/browse/METRON-1526?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16444465#comment-16444465
]
ASF GitHub Bot commented on METRON-1526:
----------------------------------------
Github user cestella commented on the issue:
https://github.com/apache/metron/pull/995
> I'm not following. A patch would only include the field to be added,
changed, or removed.
JSONPatch, the input that we accept for the `patch` command, offers more
than add, change and remove operations. There is also move and add supports
adding into an array. My point is that the format is more complex than just
passing in a list of fields to add, change or remove.
> If for some reason a user is trying to directly update a generated field
that is incorrect and a user error.
Consider this from a user perspective for a moment. How would a user know
if a field is generated or not? If we could determine which fields were
generated to ensure the users aren't given the ability to change them, then we
could whitelist them generally and solve this problem.
I'm not opposed to partial updates, but I don't see that as a solution to
the problem from this PR. It feels like kicking the can down the road and
making it the user's problem, which I don't agree with.
> Location field types cause DocValuesField appear more than once error
> ---------------------------------------------------------------------
>
> Key: METRON-1526
> URL: https://issues.apache.org/jira/browse/METRON-1526
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
> Assignee: Ryan Merriman
> Priority: Major
>
> While testing [https://github.com/apache/metron/pull/970] I get this error
> when creating a meta alert:
> {code:java}
> Error from server at http://10.0.2.15:8983/solr/bro: Exception writing
> document id bbc150f5-92f8-485d-93cc-11730c1edf31 to the index; possible
> analysis error: DocValuesField
> \"enrichments.geo.ip_dst_addr.location_point_0_coordinate\" appears more than
> once in this document (only one value is allowed per field){code}
> I tracked it down to the fact that multiple fields are returned for a
> location field. For example when a field named
> "enrichments.geo.ip_dst_addr.location_point" is configured in a schema, these
> fields are returned in a query:
> {code:java}
> {
> "enrichments.geo.ip_dst_addr.location_point_0_coordinate": "33.4499",
> "enrichments.geo.ip_dst_addr.location_point_1_coordinate": "-112.0712",
> "enrichments.geo.ip_dst_addr.location_point": "33.4499,-112.0712"
> }
> {code}
> We need a way to either suppress these extra fields when querying or remove
> them before updating a document.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
