Github user justinleet commented on the issue:
https://github.com/apache/metron/pull/970
@mmiklavc
Re: The index issue appears to be preexisting.
https://github.com/apache/metron/blob/feature/METRON-1416-upgrade-solr/metron-platform/metron-solr/src/main/java/org/apache/metron/solr/dao/SolrSearchDao.java#L231
. If you're okay with it, I think we make a another ticket against the parent
ticket and resolve it separately.
Re: the child alert's metaalerts field. That field doesn't actually do
anything and is an artifact of the denormalization process. What happens there
is that we just update the status of the metaalert, without updating
denormalized alert's metaalert links (which are unused anyway and exist because
it's more work and messy to update them on something we've already decided
isn't active).
Having said that, this points to another issue further on. Check out
https://github.com/apache/metron/pull/970/files#diff-b7359d01c3ffbed48b7fdaa2d32169e7R246.
The process of updating from inactive to active is slightly incomplete.
Say we have these three steps:
- Metaalert is updated to inactive
- (Former) child alert is updated.
- Metaalert is made active again.
The update will be missing from the metaalert. We need to update the
metaalert with the current state of any alerts (which we conveniently have
because we needed to update them all anyway!). This is a problem with both ES
and Solr (which shouldn't be surprising since that link is to the abstract DAO.
It also needs an associated test case.
---
