Github user justinleet commented on the issue:
https://github.com/apache/metron/pull/970
The workaround for the intermittent failure described above was changed.
The workaround didn't produce complete results for children. Instead, I've
moved to a second query that pulls in the complete metaalert (for any present)
and merges the results. The pro is that this entirely avoids the issue by
making the child doc transformer only act on parent metaalerts, but at the cost
of another network hop and an iteration through results.
The test has been updated to pick up the original failure.
---
