[
https://issues.apache.org/jira/browse/METRON-578?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15690446#comment-15690446
]
ASF GitHub Bot commented on METRON-578:
---------------------------------------
Github user justinleet commented on a diff in the pull request:
https://github.com/apache/incubator-metron/pull/363#discussion_r89341201
--- Diff:
metron-platform/metron-enrichment/src/test/java/org/apache/metron/enrichment/integration/EnrichmentIntegrationTest.java
---
@@ -163,18 +166,14 @@ public void test() throws Exception {
kafkaComponent.writeMessages(Constants.ENRICHMENT_TOPIC,
inputMessages);
ProcessorResult<List<Map<String, Object>>> result =
runner.process(getProcessor(inputMessages));
+ // We expect failures, so we don't care if result returned failure
or not
List<Map<String, Object>> docs = result.getResult();
- if (result.failed()){
- StringBuffer buffer = new StringBuffer();
- result.getBadResults(buffer);
- buffer.append(String.format("%d Valid Messages Processed",
docs.size())).append("\n");
- dumpParsedMessages(docs,buffer);
- Assert.fail(buffer.toString());
- } else {
- Assert.assertEquals(inputMessages.size(), docs.size());
- List<Map<String, Object>> cleanedDocs = docs;
- validateAll(cleanedDocs);
- }
+ Assert.assertEquals(inputMessages.size(), docs.size());
--- End diff --
In the GenericEnrichmentBolt, in the event of an error that leads to the
error stream, it still emits in order to not kill the entire processing in the
event of one enrichment being broken (code snippet from that class down below).
Both the regular output and the error stream get emitted, so the end result
still has the enriched docs as before I hooked the error enrichment up to the
topic (so inputMessages.size() should still be the same as docs.size(), except
now there are also (nonfatal) errors we can check in addition to the regular
results.
See:
```
JSONObject enrichedMessage = new JSONObject();
enrichedMessage.put("adapter." +
adapter.getClass().getSimpleName().toLowerCase() + ".begin.ts", "" +
System.currentTimeMillis());
try {
// Actual logic
if (enrichedMessage != null && !enrichedMessage.isEmpty()) {
collector.emit(enrichmentType, new Values(key, enrichedMessage,
subGroup));
}
} catch (Exception e) {
LOG.error("[Metron] Unable to enrich message: " + rawMessage, e);
JSONObject error = ErrorUtils.generateErrorMessage("Enrichment
problem: " + rawMessage, e);
if (key != null) {
collector.emit(enrichmentType, new Values(key, enrichedMessage,
subGroup));
}
collector.emit("error", new Values(error));
}
```
> Missing error handling bolts for enrichment and threat intel
> ------------------------------------------------------------
>
> Key: METRON-578
> URL: https://issues.apache.org/jira/browse/METRON-578
> Project: Metron
> Issue Type: Improvement
> Affects Versions: 0.2.1BETA
> Reporter: Justin Leet
> Assignee: Justin Leet
>
> TL;DR - we need to add error handling to enrichments/threat intel
> Metron has parsers, enrichment + threat intel, and indexing topologies
> currently. Parsers and and enrichment have bolts that write to error topics
> in Kafka
> # indexing_error
> # parser_error
> # parser_invalid
> The GenericEnrichmentBolt handles errors gracefully by passing along failed
> enrichment tuples un-enriched and additionally emitting the tuple to an
> "error" stream, however there is currently no plumbing to handle the error
> stream.
> {code:java}
> } catch (Exception e) {
> LOG.error("[Metron] Unable to enrich message: " + rawMessage, e);
> JSONObject error = ErrorUtils.generateErrorMessage("Enrichment problem:
> " + rawMessage, e);
> if (key != null) {
> collector.emit(enrichmentType, new Values(key, enrichedMessage,
> subGroup));
> }
> collector.emit("error", new Values(error));
> }
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
