[
https://issues.apache.org/jira/browse/METRON-1526?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16449690#comment-16449690
]
ASF GitHub Bot commented on METRON-1526:
----------------------------------------
Github user justinleet commented on the issue:
https://github.com/apache/metron/pull/995
@mmiklavc That sounds right, yes. For returning dynamic fields (at least on
the known problematic fields), I don't think it's pretty much ever
advantageous. At most it avoids a split on the LatLon result to pull out just
latitude or longitude. I think the newer version of geospatial,
LatLonPointSpatialField, is in the list not problematic list, so presumably
this realization was made and it's handled similar to others.
As an aside, looking through the javadocs, there's this remark on
PointFields
>FieldCache is not supported for PointFields, so sorting, faceting, etc on
these fields require the use of docValues="true" in the schema.
Even though we don't use PointField in our schemas, we may still want to
make that note in our docs. Seems like a fairly important caveat.
We could also potentially, based on
https://lucene.apache.org/solr/guide/6_6/docvalues.html#DocValues-RetrievingDocValuesDuringSearch,
set `useDocValuesAsStored="false"`, which might sidestep this problem
entirely. The catch is I think there's a whole set of considerations regarding
performance and querying that I do not have the expertise to assess.
@merrimanr Are there any circumstances where we'd want copy fields? It
seems like we could just direct users to make a copy of the field in Metron and
just index the copy fields directly. The main concern would be if we're able to
manage globs in there, but even if we don't it doesn't seem like super
important functionality to support. At least at a glance; I may definitely be
missing use cases.
> Location field types cause DocValuesField appear more than once error
> ---------------------------------------------------------------------
>
> Key: METRON-1526
> URL: https://issues.apache.org/jira/browse/METRON-1526
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
> Assignee: Ryan Merriman
> Priority: Major
>
> While testing [https://github.com/apache/metron/pull/970] I get this error
> when creating a meta alert:
> {code:java}
> Error from server at http://10.0.2.15:8983/solr/bro: Exception writing
> document id bbc150f5-92f8-485d-93cc-11730c1edf31 to the index; possible
> analysis error: DocValuesField
> \"enrichments.geo.ip_dst_addr.location_point_0_coordinate\" appears more than
> once in this document (only one value is allowed per field){code}
> I tracked it down to the fact that multiple fields are returned for a
> location field. For example when a field named
> "enrichments.geo.ip_dst_addr.location_point" is configured in a schema, these
> fields are returned in a query:
> {code:java}
> {
> "enrichments.geo.ip_dst_addr.location_point_0_coordinate": "33.4499",
> "enrichments.geo.ip_dst_addr.location_point_1_coordinate": "-112.0712",
> "enrichments.geo.ip_dst_addr.location_point": "33.4499,-112.0712"
> }
> {code}
> We need a way to either suppress these extra fields when querying or remove
> them before updating a document.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
