[
https://issues.apache.org/jira/browse/METRON-680?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15847914#comment-15847914
]
ASF GitHub Bot commented on METRON-680:
---------------------------------------
GitHub user justinleet opened a pull request:
https://github.com/apache/incubator-metron/pull/431
METRON-680: GeoLiteDatabase incorrectly using country geoname_id instead of
city
See the discussion [METRON-680](
https://issues.apache.org/jira/browse/METRON-680) for more info. This
implements the easy country -> city change. The two fields have the exact same
format (they're both ids from geonames.org)
The main concern I have is what happens given that that the
"Unique-Location(s)" visualization in Kibana uses locId directly. Changing
what gets passed to it affects what shows up in that field.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/justinleet/incubator-metron METRON-680
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/incubator-metron/pull/431.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #431
----
commit 8cd13f44d9c23c6355f21f46284a42ddf55885f9
Author: justinjleet <[email protected]>
Date: 2017-02-01T03:07:31Z
METRON-680: GeoLiteDatabase incorrectly using country geoname_id instead of
city
----
> GeoLiteDatabase incorrectly using country geoname_id instead of city
> --------------------------------------------------------------------
>
> Key: METRON-680
> URL: https://issues.apache.org/jira/browse/METRON-680
> Project: Metron
> Issue Type: Bug
> Reporter: Justin Leet
> Assignee: Justin Leet
> Priority: Minor
>
> Due to misunderstanding exactly how things tied together with the updated
> database, the wrong field is used for the locId. Instead of using the city's
> geoname_id, we are using the country's.
> This will effect Kibana dashboards and anything that depends on the locId,
> because it will be retrieved at the country level instead of the city level.
> The change will not break anything (anything not at the city level uses the
> country's code, e.g. if the IP is for Japan in general, the city code is
> 1861060, not empty or null). This example from the plaintext database can be
> seen in the second and third fields at:
> bq. 1.112.0.0/15,1861060,1861060,,0,0,,35.6900,139.6900,500
> The offending code is in `GeoLiteDatabase.java` and should be
> `geoInfo.put("locID", convertNullToEmptyString(country.getGeoNameId()));`
> This should be updated to grab the city's geoname, and tests should be
> updated to reflect this (they didn't catch this error because of the
> misunderstood data change, not an error in coding).
> Ideally, this field is renamed and better documented as part of METRON-679
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
