[
https://issues.apache.org/jira/browse/METRON-249?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15623361#comment-15623361
]
ASF GitHub Bot commented on METRON-249:
---------------------------------------
Github user ottobackwards commented on the issue:
https://github.com/apache/incubator-metron/pull/333
I think what we are seeing with the question here, the handling of null's
in the arithmetic functions and other recent work here is that it is confusing
and possibly inconsistent. Maybe it can explained better ( is there a Stellar
Language Guide to how parameters are handled? I don't think the doc we have is
enough ), or maybe it needs some more ... coordinated work as opposed to a
bunch of bugs getting fixed separately.
> Field Transformation functions fail to handle invalid user inputs
> ------------------------------------------------------------------
>
> Key: METRON-249
> URL: https://issues.apache.org/jira/browse/METRON-249
> Project: Metron
> Issue Type: Bug
> Reporter: Neha Sinha
> Priority: Minor
> Labels: platform
> Fix For: 0.2.1BETA
>
> Attachments: LogException.rtf
>
>
> Hi,
> The field transformation functions fail to handle invalid user input .On
> providing invalid inputs the parser throws exceptions and fails to create the
> required indices in elasticsearch.
> ==========================
> Steps to Reproduce
> ==========================
> Edit the squid.json file and provide the following definition to it:-(Note-we
> are giving an invalid input :-123 to the URL_TO_HOST function)
> -----------------------------------------------------------------------------------------------
> {
> "parserClassName": "org.apache.metron.parsers.GrokParser",
> "sensorTopic": "squid",
> "parserConfig": {
> "grokPath": "/patterns/squid",
> "patternLabel": "SQUID_DELIMITED",
> "timestampField": "timestamp"
> },
> "fieldTransformations" : [
> {
> "transformation" : "MTL"
> ,"output" : [ "full_hostname", "domain_without_subdomains" ]
> ,"config" : {
> "full_hostname" : “URL_TO_HOST(123)"
> ,"domain_without_subdomains" : "DOMAIN_REMOVE_SUBDOMAINS(full_hostname)"
> }
> }
> ]
> }
> ----------------------------------------------------------------------------------------------------
> Replay Squid events/logs and monitor the logs in storm for squid topology.
> Attached exception log would be seen and no indexes would be created
> respective to the logs.
> Expected Behaviour :-
> 1.The error should be more clean.
> 2.Since we cannot validate the inputs the invalid inputs should be ignored
> and the indices should get created anyway based on the Grok parser output
> Regards,
> Neha
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
