Justin Leet created METRON-649:
----------------------------------
Summary: Improve handling of dates in parsers when year is missing
from data
Key: METRON-649
URL: https://issues.apache.org/jira/browse/METRON-649
Project: Metron
Issue Type: Bug
Reporter: Justin Leet
METRON-647 makes a change in the tests to match expected output to the existing
parser behavior to alleviate year related issues.
The larger issue discovered as we looked into it is that some parsers (at least
GrokWebSphereParser) assume everything is in the current year. E.g. if it's Jan
4th, 2017 and we get a message for April 15 the assumption is made that the
message is from April 15, 2017. It seems unlikely we want to just toss any data
like this as being bad, but we need some handling or rules around what happens
for formats like this.
A potential solution is to assume that the year should assume a past date if
it's from a future date (assume April 15, 2016 instead of April 15, 2017).
However, there are potential replay use cases where this might not be
sufficient (e.g. we've have data for a few years and it's actually from April
15, 2013).
We need to figure out a strategy for how we handle cases like this, in addition
to ensuring any existing parsers handle it appropriately. In addition, the
solution needs to be appropriately documented.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
