Neha Sinha created METRON-249:
---------------------------------
Summary: Field Transformation function fail to handle invalid user
inputs
Key: METRON-249
URL: https://issues.apache.org/jira/browse/METRON-249
Project: Metron
Issue Type: Bug
Reporter: Neha Sinha
Hi,
The field transformation functions fail to handle invalid user input .On
providing invalid inputs the parser throws exceptions and fails to create the
required indices in elasticsearch.
==========================
Steps to Reproduce
==========================
Edit the squid.json file and provide the following definition to it:-(Note-we
are giving an invalid input :-123 to the URL_TO_HOST function)
-----------------------------------------------------------------------------------------------
{
"parserClassName": "org.apache.metron.parsers.GrokParser",
"sensorTopic": "squid",
"parserConfig": {
"grokPath": "/patterns/squid",
"patternLabel": "SQUID_DELIMITED",
"timestampField": "timestamp"
},
"fieldTransformations" : [
{
"transformation" : "MTL"
,"output" : [ "full_hostname", "domain_without_subdomains" ]
,"config" : {
"full_hostname" : “URL_TO_HOST(123)"
,"domain_without_subdomains" : "DOMAIN_REMOVE_SUBDOMAINS(full_hostname)"
}
}
]
}
----------------------------------------------------------------------------------------------------
Replay Squid events/logs and monitor the logs in storm for squid topology.
Attached exception log would be seen and no indexes would be created respective
to the logs.
Expected Behaviour :-
1.The error should be more clean.
2.Since we cannot validate the inputs the invalid inputs should be ignored and
the indices should get created anyway based on the Grok parser output
Regards,
Neha
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
