[
https://issues.apache.org/jira/browse/METRON-1869?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Nick Allen updated METRON-1869:
-------------------------------
Description:
Steps to Replicate:
# Create a meta-alert.
# Escalate the meta-alert.
# Trigger a search in the UI.
# Subsequent searches from the Alerts UI trigger the following exception in
the REST service logs.
# Meta-alerts are no longer visible in the Alerts UI.
{code:java}
18/11/12 22:25:50 ERROR dao.ElasticsearchRequestSubmitter: Shard search failure
[1/1]; reason=ElasticsearchException: Elasticsearch exception
[type=illegal_argument_exception, reason=Fielddata is disabled on text fields
by default. Set fielddata=true on [alert_status] in order to load fielddata in
memory by uninverting the inverted index. Note that this can however use
significant memory. Alternatively use a keyword field instead.],
index=metaalert_index, shard=0, status=INTERNAL_SERVER_ERROR,
nodeId=uuG7-lZoSiaowJK_cUD4IQ
ElasticsearchException[Elasticsearch exception
[type=illegal_argument_exception, reason=Fielddata is disabled on text fields
by default. Set fielddata=true on [alert_status] in order to load fielddata in
memory by uninverting the inverted index. Note that this can however use
significant memory. Alternatively use a keyword field instead.]]
at
org.elasticsearch.ElasticsearchException.innerFromXContent(ElasticsearchException.java:490)
at
org.elasticsearch.ElasticsearchException.fromXContent(ElasticsearchException.java:406)
at
org.elasticsearch.action.search.ShardSearchFailure.fromXContent(ShardSearchFailure.java:205)
at
org.elasticsearch.action.search.SearchResponse.fromXContent(SearchResponse.java:297)
at
org.elasticsearch.client.RestHighLevelClient.parseEntity(RestHighLevelClient.java:526)
at
org.elasticsearch.client.RestHighLevelClient.lambda$performRequestAndParseEntity$2(RestHighLevelClient.java:382)
at
org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:413)
at
org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:382)
at
org.elasticsearch.client.RestHighLevelClient.search(RestHighLevelClient.java:323)
at
org.apache.metron.elasticsearch.dao.ElasticsearchRequestSubmitter.submitSearch(ElasticsearchRequestSubmitter.java:62)
at
org.apache.metron.elasticsearch.dao.ElasticsearchSearchDao.search(ElasticsearchSearchDao.java:128)
at
org.apache.metron.elasticsearch.dao.ElasticsearchDao.search(ElasticsearchDao.java:191)
at
org.apache.metron.elasticsearch.dao.ElasticsearchMetaAlertSearchDao.search(ElasticsearchMetaAlertSearchDao.java:81)
at
org.apache.metron.elasticsearch.dao.ElasticsearchMetaAlertDao.search(ElasticsearchMetaAlertDao.java:209)
at
org.apache.metron.rest.service.impl.SearchServiceImpl.search(SearchServiceImpl.java:92)
at
org.apache.metron.rest.controller.SearchController.search(SearchController.java:54){code}
was:
Steps to Replicate:
# Create a meta-alert.
# Escalate the meta-alert.
# Trigger a search in the UI.
# Subsequent searches from the Alerts UI trigger the following exception in
the REST service logs.
{code:java}
18/11/12 22:25:50 ERROR dao.ElasticsearchRequestSubmitter: Shard search failure
[1/1]; reason=ElasticsearchException: Elasticsearch exception
[type=illegal_argument_exception, reason=Fielddata is disabled on text fields
by default. Set fielddata=true on [alert_status] in order to load fielddata in
memory by uninverting the inverted index. Note that this can however use
significant memory. Alternatively use a keyword field instead.],
index=metaalert_index, shard=0, status=INTERNAL_SERVER_ERROR,
nodeId=uuG7-lZoSiaowJK_cUD4IQ
ElasticsearchException[Elasticsearch exception
[type=illegal_argument_exception, reason=Fielddata is disabled on text fields
by default. Set fielddata=true on [alert_status] in order to load fielddata in
memory by uninverting the inverted index. Note that this can however use
significant memory. Alternatively use a keyword field instead.]]
at
org.elasticsearch.ElasticsearchException.innerFromXContent(ElasticsearchException.java:490)
at
org.elasticsearch.ElasticsearchException.fromXContent(ElasticsearchException.java:406)
at
org.elasticsearch.action.search.ShardSearchFailure.fromXContent(ShardSearchFailure.java:205)
at
org.elasticsearch.action.search.SearchResponse.fromXContent(SearchResponse.java:297)
at
org.elasticsearch.client.RestHighLevelClient.parseEntity(RestHighLevelClient.java:526)
at
org.elasticsearch.client.RestHighLevelClient.lambda$performRequestAndParseEntity$2(RestHighLevelClient.java:382)
at
org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:413)
at
org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:382)
at
org.elasticsearch.client.RestHighLevelClient.search(RestHighLevelClient.java:323)
at
org.apache.metron.elasticsearch.dao.ElasticsearchRequestSubmitter.submitSearch(ElasticsearchRequestSubmitter.java:62)
at
org.apache.metron.elasticsearch.dao.ElasticsearchSearchDao.search(ElasticsearchSearchDao.java:128)
at
org.apache.metron.elasticsearch.dao.ElasticsearchDao.search(ElasticsearchDao.java:191)
at
org.apache.metron.elasticsearch.dao.ElasticsearchMetaAlertSearchDao.search(ElasticsearchMetaAlertSearchDao.java:81)
at
org.apache.metron.elasticsearch.dao.ElasticsearchMetaAlertDao.search(ElasticsearchMetaAlertDao.java:209)
at
org.apache.metron.rest.service.impl.SearchServiceImpl.search(SearchServiceImpl.java:92)
at
org.apache.metron.rest.controller.SearchController.search(SearchController.java:54){code}
> Unable to Escalate Meta Alert
> -----------------------------
>
> Key: METRON-1869
> URL: https://issues.apache.org/jira/browse/METRON-1869
> Project: Metron
> Issue Type: Bug
> Reporter: Nick Allen
> Assignee: Nick Allen
> Priority: Major
>
> Steps to Replicate:
> # Create a meta-alert.
> # Escalate the meta-alert.
> # Trigger a search in the UI.
> # Subsequent searches from the Alerts UI trigger the following exception in
> the REST service logs.
> # Meta-alerts are no longer visible in the Alerts UI.
> {code:java}
> 18/11/12 22:25:50 ERROR dao.ElasticsearchRequestSubmitter: Shard search
> failure [1/1]; reason=ElasticsearchException: Elasticsearch exception
> [type=illegal_argument_exception, reason=Fielddata is disabled on text fields
> by default. Set fielddata=true on [alert_status] in order to load fielddata
> in memory by uninverting the inverted index. Note that this can however use
> significant memory. Alternatively use a keyword field instead.],
> index=metaalert_index, shard=0, status=INTERNAL_SERVER_ERROR,
> nodeId=uuG7-lZoSiaowJK_cUD4IQ
> ElasticsearchException[Elasticsearch exception
> [type=illegal_argument_exception, reason=Fielddata is disabled on text fields
> by default. Set fielddata=true on [alert_status] in order to load fielddata
> in memory by uninverting the inverted index. Note that this can however use
> significant memory. Alternatively use a keyword field instead.]]
> at
> org.elasticsearch.ElasticsearchException.innerFromXContent(ElasticsearchException.java:490)
> at
> org.elasticsearch.ElasticsearchException.fromXContent(ElasticsearchException.java:406)
> at
> org.elasticsearch.action.search.ShardSearchFailure.fromXContent(ShardSearchFailure.java:205)
> at
> org.elasticsearch.action.search.SearchResponse.fromXContent(SearchResponse.java:297)
> at
> org.elasticsearch.client.RestHighLevelClient.parseEntity(RestHighLevelClient.java:526)
> at
> org.elasticsearch.client.RestHighLevelClient.lambda$performRequestAndParseEntity$2(RestHighLevelClient.java:382)
> at
> org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:413)
> at
> org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:382)
> at
> org.elasticsearch.client.RestHighLevelClient.search(RestHighLevelClient.java:323)
> at
> org.apache.metron.elasticsearch.dao.ElasticsearchRequestSubmitter.submitSearch(ElasticsearchRequestSubmitter.java:62)
> at
> org.apache.metron.elasticsearch.dao.ElasticsearchSearchDao.search(ElasticsearchSearchDao.java:128)
> at
> org.apache.metron.elasticsearch.dao.ElasticsearchDao.search(ElasticsearchDao.java:191)
> at
> org.apache.metron.elasticsearch.dao.ElasticsearchMetaAlertSearchDao.search(ElasticsearchMetaAlertSearchDao.java:81)
> at
> org.apache.metron.elasticsearch.dao.ElasticsearchMetaAlertDao.search(ElasticsearchMetaAlertDao.java:209)
> at
> org.apache.metron.rest.service.impl.SearchServiceImpl.search(SearchServiceImpl.java:92)
> at
> org.apache.metron.rest.controller.SearchController.search(SearchController.java:54){code}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
