[
https://issues.apache.org/jira/browse/METRON-1526?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16448987#comment-16448987
]
ASF GitHub Bot commented on METRON-1526:
----------------------------------------
Github user mmiklavc commented on the issue:
https://github.com/apache/metron/pull/995
@justinleet - Thanks for that write up - that helps considerably.
Just to round out @merrimanr 's comment about polyfields:
>At this point I question whether a field being a polyfield is causing this
issue. The testing I've done does not support that. Javadocs for
FieldType.isPolyField() state:
>>A "polyField" is a FieldType that can produce more than one
IndexableField instance for a single value
So, from the last few examples discussed it suggests to me that being a
polyfield *is* actually a problem, but it's only part of the total reason for
the problem. Under the hood they are setting stored=false and docValues=false
for currency and some of the other polyfields, whereas they aren't doing this
for LatLonType and Point. Does that sound about right? I saw mention of Date
also, and some comments about LatLonType being the only problem data type, so
it would be good to summarize again what field types are specifically a problem.
One bit I'm not completely clear on after the rounds of discussion is when
it's desirable to return the dynamic/subfields generated by virtue of being a
polyfield, and further how the doc update code is managing that differently
from a normal search. For a standard doc query in context of performing an
update, we don't want dynamically generated fields returned because that will
bork the re-index. For a user glob query, we *do* want then returned because
they may be useful to some users? Is that hovering around accurate?
> Location field types cause DocValuesField appear more than once error
> ---------------------------------------------------------------------
>
> Key: METRON-1526
> URL: https://issues.apache.org/jira/browse/METRON-1526
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
> Assignee: Ryan Merriman
> Priority: Major
>
> While testing [https://github.com/apache/metron/pull/970] I get this error
> when creating a meta alert:
> {code:java}
> Error from server at http://10.0.2.15:8983/solr/bro: Exception writing
> document id bbc150f5-92f8-485d-93cc-11730c1edf31 to the index; possible
> analysis error: DocValuesField
> \"enrichments.geo.ip_dst_addr.location_point_0_coordinate\" appears more than
> once in this document (only one value is allowed per field){code}
> I tracked it down to the fact that multiple fields are returned for a
> location field. For example when a field named
> "enrichments.geo.ip_dst_addr.location_point" is configured in a schema, these
> fields are returned in a query:
> {code:java}
> {
> "enrichments.geo.ip_dst_addr.location_point_0_coordinate": "33.4499",
> "enrichments.geo.ip_dst_addr.location_point_1_coordinate": "-112.0712",
> "enrichments.geo.ip_dst_addr.location_point": "33.4499,-112.0712"
> }
> {code}
> We need a way to either suppress these extra fields when querying or remove
> them before updating a document.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
