[GitHub] merrimanr commented on issue #1331: METRON-1993: Stellar REST_GET should handle responses when content length is less than zero

2019-02-08 Thread GitBox
merrimanr commented on issue #1331: METRON-1993: Stellar REST_GET should handle 
responses when content length is less than zero
URL: https://github.com/apache/metron/pull/1331#issuecomment-461972658
 
 
   The latest commit adds a debug line with a summary of the request/response.  
That should make it easier to troubleshoot issues like this in the future.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] ottobackwards commented on a change in pull request #1330: METRON-1968: Messages are lost when a parser produces multiple messages and batch size is greater than 1

2019-02-08 Thread GitBox
ottobackwards commented on a change in pull request #1330: METRON-1968: 
Messages are lost when a parser produces multiple messages and batch size is 
greater than 1
URL: https://github.com/apache/metron/pull/1330#discussion_r255236346
 
 

 ##
 File path: 
metron-platform/metron-parsing/metron-parsing-storm/src/main/java/org/apache/metron/parsers/bolt/ParserBolt.java
 ##
 @@ -326,6 +329,10 @@ protected void handleError(String sensorType, byte[] 
originalMessage, Tuple tupl
 ErrorUtils.handleError(collector, error);
   }
 
 
 Review comment:
   @merrimanr I think that is a better change, unless we can find a consistent 
and already existing id to use ( which I don't see either ).
   We should just move ahead with this approach


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] merrimanr opened a new pull request #1335: METRON-1998: Only one sensor is flushed by tick tuple

2019-02-08 Thread GitBox
merrimanr opened a new pull request #1335: METRON-1998: Only one sensor is 
flushed by tick tuple
URL: https://github.com/apache/metron/pull/1335
 
 
   ## Contributor Comments
   This PR fixes the bug described in the Jira by removing the incorrect return 
statement.  I also added a unit test to catch this in the future.
   
   ## Pull Request Checklist
   
   Thank you for submitting a contribution to Apache Metron.  
   Please refer to our [Development 
Guidelines](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61332235)
 for the complete guide to follow for contributions.  
   Please refer also to our [Build Verification 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Verifying+Builds?show-miniview)
 for complete smoke testing guides.  
   
   
   In order to streamline the review of the contribution we ask you follow 
these guidelines and ask you to double check the following:
   
   ### For all changes:
   - [x] Is there a JIRA ticket associated with this PR? If not one needs to be 
created at [Metron 
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
   - [x] Does your PR title start with METRON- where  is the JIRA 
number you are trying to resolve? Pay particular attention to the hyphen "-" 
character.
   - [x] Has your PR been rebased against the latest commit within the target 
branch (typically master)?
   
   
   ### For code changes:
   - [ ] Have you included steps to reproduce the behavior or problem that is 
being changed or addressed?
   - [ ] Have you included steps or a guide to how the change may be verified 
and tested manually?
   - [ ] Have you ensured that the full suite of tests and checks have been 
executed in the root metron folder via:
 ```
 mvn -q clean integration-test install && 
dev-utilities/build-utils/verify_licenses.sh 
 ```
   
   - [x] Have you written or updated unit tests and or integration tests to 
verify your changes?
   - [x] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)?
   - [ ] Have you verified the basic functionality of the build by building and 
running locally with Vagrant full-dev environment or the equivalent?
   
   ### For documentation related changes:
   - [x] Have you ensured that format looks appropriate for the output in which 
it is rendered by building and verifying the site-book? If not then run the 
following commands and the verify changes via 
`site-book/target/site/index.html`:
   
 ```
 cd site-book
 mvn site
 ```
   
    Note:
   Please ensure that once the PR is submitted, you check travis-ci for build 
issues and submit an update to your PR as soon as possible.
   It is also recommended that [travis-ci](https://travis-ci.org) is set up for 
your personal repository such that your branches are built there before 
submitting a pull request.
   


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[jira] [Created] (METRON-1998) Only one sensor is flushed by tick tuple

2019-02-08 Thread Ryan Merriman (JIRA)
Ryan Merriman created METRON-1998:
-

 Summary: Only one sensor is flushed by tick tuple
 Key: METRON-1998
 URL: https://issues.apache.org/jira/browse/METRON-1998
 Project: Metron
  Issue Type: Bug
Reporter: Ryan Merriman


The BulkWriterComponent maintains an internal map of sensors to message 
batches.  The flushTimeouts method incorrectly returns after one of the 
sensor's batch timeout is reached and flushed.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] JonZeolla commented on issue #23: [DEPENDS ON METRON-1910] METRON-1992: Support sending a log to multiple topics

2019-02-08 Thread GitBox
JonZeolla commented on issue #23: [DEPENDS ON METRON-1910] METRON-1992: Support 
sending a log to multiple topics
URL: 
https://github.com/apache/metron-bro-plugin-kafka/pull/23#issuecomment-461897366
 
 
   By the way, I found the following helpful when validating this works via 
docker.
   ```
   diff --git a/docker/in_docker_scripts/configure_bro_plugin.sh 
b/docker/in_docker_scripts/configure_bro_plugin.sh
   index 74551c2..7eb2c2c 100755
   --- a/docker/in_docker_scripts/configure_bro_plugin.sh
   +++ b/docker/in_docker_scripts/configure_bro_plugin.sh
   @@ -29,12 +29,22 @@ echo "Configuring kafka plugin"
{
  echo "@load packages"
  echo "redef Kafka::logs_to_send = set(HTTP::LOG, DNS::LOG, Conn::LOG, 
DPD::LOG, FTP::LOG, Files::LOG, Known::CERTS_LOG, SMTP::LOG, SSL::LOG, 
Weird::LOG, Notice::LOG, DHCP::LOG, SSH::LOG, Software::LOG, RADIUS::LOG, 
X509::LOG, Known::DEVICES_LOG, RFB::LOG, Stats::LOG, CaptureLoss::LOG, 
SIP::LOG);"
   -  echo "redef Kafka::topic_name = \"bro\";"
   +  echo "redef Kafka::topic_name = \"notbro\";"
  echo "redef Kafka::tag_json = T;"
  echo "redef Kafka::kafka_conf = table([\"metadata.broker.list\"] = 
\"kafka:9092\");"
  echo "redef Kafka::logs_to_exclude = set(Conn::LOG, DHCP::LOG);"
  echo "redef Known::cert_tracking = ALL_HOSTS;"
  echo "redef Software::asset_tracking = ALL_HOSTS;"
   +  echo 'event bro_init() =-10
   +{
   +# Also send RADIUS to the bro topic
   +local shew_radius_filter: Log::Filter = [
   +$name = "kafka-radius-shew",
   +$writer = Log::WRITER_KAFKAWRITER,
   +   $config = table(["topic_name"] = "bro")
   +];
   +Log::add_filter(RADIUS::LOG, shew_radius_filter);
   +}'
} >> /usr/local/bro/share/bro/site/local.bro
   
sed -i '86 a @load policy/protocols/dhcp/known-devices-and-hostnames.bro' 
/usr/local/bro/share/bro/site/local.bro
   ```


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] JonZeolla commented on issue #23: [DEPENDS ON METRON-1910] METRON-1992: Support sending a log to multiple topics

2019-02-08 Thread GitBox
JonZeolla commented on issue #23: [DEPENDS ON METRON-1910] METRON-1992: Support 
sending a log to multiple topics
URL: 
https://github.com/apache/metron-bro-plugin-kafka/pull/23#issuecomment-461873884
 
 
   This depends on METRON-1910 because otherwise it segfaults everywhere.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] JonZeolla commented on issue #23: METRON-1992: Support sending a log to multiple topics

2019-02-08 Thread GitBox
JonZeolla commented on issue #23: METRON-1992: Support sending a log to 
multiple topics
URL: 
https://github.com/apache/metron-bro-plugin-kafka/pull/23#issuecomment-461871087
 
 
   Docker tests are successful, going to test this on my physical cluster soon.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] sardell commented on issue #1332: METRON-1995: Arrow icon in date range selector moved to a wrong position

2019-02-08 Thread GitBox
sardell commented on issue #1332: METRON-1995: Arrow icon in date range 
selector moved to a wrong position
URL: https://github.com/apache/metron/pull/1332#issuecomment-461835244
 
 
   +1. Tested on full dev. Thanks for the contribution!


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] sardell edited a comment on issue #1307: METRON-1944: Unable to Delete a Comment in Alerts UI

2019-02-08 Thread GitBox
sardell edited a comment on issue #1307: METRON-1944: Unable to Delete a 
Comment in Alerts UI
URL: https://github.com/apache/metron/pull/1307#issuecomment-459289038
 
 
   ~~+1. Glad to see the unit test for the comment deletion functionality. 
Hopefully in the near future, we can extend the unit test coverage for this 
component, but for now I think this is good. Thanks for the contribution, 
@ruffle1986!~~
   
   EDIT: @ruffle1986 After further testing, I think I caught a bug in this code 
(though it may have existed before and didn't show because of the comment 
deletion being broken). Here are the steps to reproduce:
   
   * Open the details panel for an alert
   * Add a comment, then delete it.
   * Close and reopen the details panel for the alert you just had open.
   * The comment reappears. If you delete the comment again and repeat the 
close/reopen steps, it's finally deleted.


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] MohanDV opened a new pull request #1333: METRON-1996 : Index search using group for Solr throws NPE if the group parameter is null

2019-02-08 Thread GitBox
MohanDV opened a new pull request #1333: METRON-1996 : Index search using group 
for Solr throws NPE if the group parameter is null
URL: https://github.com/apache/metron/pull/1333
 
 
   ## Contributor Comments
   Index search using group for Solr throws NPE if the group parameter is null, 
also returns no content message if the group list is empty.
   
   ## Pull Request Checklist
   Thank you for submitting a contribution to Apache Metron.  
   Please refer to our [Development 
Guidelines](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61332235)
 for the complete guide to follow for contributions.  
   Please refer also to our [Build Verification 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Verifying+Builds?show-miniview)
 for complete smoke testing guides.  
   
   
   In order to streamline the review of the contribution we ask you follow 
these guidelines and ask you to double check the following:
   
   ### For all changes:
   - [x] Is there a JIRA ticket associated with this PR? If not one needs to be 
created at [Metron 
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
   - [x] Does your PR title start with METRON- where  is the JIRA 
number you are trying to resolve? Pay particular attention to the hyphen "-" 
character.
   - [x] Has your PR been rebased against the latest commit within the target 
branch (typically master)?
   
   
   ### For code changes:
   - [] Have you included steps to reproduce the behavior or problem that is 
being changed or addressed?
   - [ ] Have you included steps or a guide to how the change may be verified 
and tested manually?
   - [ ] Have you ensured that the full suite of tests and checks have been 
executed in the root metron folder via:
 ```
 mvn -q clean integration-test install && 
dev-utilities/build-utils/verify_licenses.sh 
 ```
   
   - [ ] Have you written or updated unit tests and or integration tests to 
verify your changes?
   - [ ] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)?
   - [ ] Have you verified the basic functionality of the build by building and 
running locally with Vagrant full-dev environment or the equivalent?
   
   ### For documentation related changes:
   - [ ] Have you ensured that format looks appropriate for the output in which 
it is rendered by building and verifying the site-book? If not then run the 
following commands and the verify changes via 
`site-book/target/site/index.html`:
   
 ```
 cd site-book
 mvn site
 ```
   
    Note:
   Please ensure that once the PR is submitted, you check travis-ci for build 
issues and submit an update to your PR as soon as possible.
   It is also recommended that [travis-ci](https://travis-ci.org) is set up for 
your personal repository such that your branches are built there before 
submitting a pull request.
   


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] MohanDV closed pull request #1333: METRON-1996 : Index search using group for Solr throws NPE if the group parameter is null

2019-02-08 Thread GitBox
MohanDV closed pull request #1333: METRON-1996 : Index search using group for 
Solr throws NPE if the group parameter is null
URL: https://github.com/apache/metron/pull/1333
 
 
   


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[jira] [Updated] (METRON-1992) Support sending a log to multiple topics

2019-02-08 Thread Jon Zeolla (JIRA)


 [ 
https://issues.apache.org/jira/browse/METRON-1992?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Jon Zeolla updated METRON-1992:
---
Description: The bro plugin is currently unable to send a single bro log to 
multiple different kafka topics in the same kafka cluster.  In order to support 
the ability to do streaming enrichment of bro logs using bro logs from the same 
bro cluster, this should be supported.  (was: Right now, in the 
metron-bro-plugin-kafka plugin it's difficult to send a single bro log to 
multiple different kafka topics.  As needed, adjust the configs and provide an 
example in the README.  

See the "Logging to Multiple Subscribers" section in the 
https://github.com/ncsa/bro-zeromq-writer)

> Support sending a log to multiple topics
> 
>
> Key: METRON-1992
> URL: https://issues.apache.org/jira/browse/METRON-1992
> Project: Metron
>  Issue Type: Improvement
>Reporter: Jon Zeolla
>Assignee: Jon Zeolla
>Priority: Major
>  Time Spent: 1h
>  Remaining Estimate: 0h
>
> The bro plugin is currently unable to send a single bro log to multiple 
> different kafka topics in the same kafka cluster.  In order to support the 
> ability to do streaming enrichment of bro logs using bro logs from the same 
> bro cluster, this should be supported.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] ruffle1986 opened a new pull request #1334: METRON-1997: Replace Threat Triage Score Field Slider with Text Box

2019-02-08 Thread GitBox
ruffle1986 opened a new pull request #1334: METRON-1997: Replace Threat Triage 
Score Field Slider with Text Box
URL: https://github.com/apache/metron/pull/1334
 
 
   ## Contributor Comments
   
   Link to the original ASF Jira ticket: 
https://issues.apache.org/jira/browse/METRON-1997
   
   Later on, we'd like Stellar expressions to be accepted as a valid threat 
triage score. As a first step, I just replaced the slider with a numeric text 
box in this PR.
   
   **Steps to test it:**
   
   1. Go to the Management UI.
   2. Click on one of the parser config`s edit button (the pen on the right). 
You name it.
   3. In the right sidebar, expand the Threat Triage option.
   4. Click on the big fat plus button in the new panel.
   5. You can find the new score input at the bottom of the new panel.
   
   ## Pull Request Checklist
   
   Thank you for submitting a contribution to Apache Metron.  
   Please refer to our [Development 
Guidelines](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61332235)
 for the complete guide to follow for contributions.  
   Please refer also to our [Build Verification 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Verifying+Builds?show-miniview)
 for complete smoke testing guides.  
   
   
   In order to streamline the review of the contribution we ask you follow 
these guidelines and ask you to double check the following:
   
   ### For all changes:
   - [X] Is there a JIRA ticket associated with this PR? If not one needs to be 
created at [Metron 
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
   - [X] Does your PR title start with METRON- where  is the JIRA 
number you are trying to resolve? Pay particular attention to the hyphen "-" 
character.
   - [X] Has your PR been rebased against the latest commit within the target 
branch (typically master)?
   
   
   ### For code changes:
   - [X] Have you included steps to reproduce the behavior or problem that is 
being changed or addressed?
   - [X] Have you included steps or a guide to how the change may be verified 
and tested manually?
   - [X] Have you ensured that the full suite of tests and checks have been 
executed in the root metron folder via:
 ```
 mvn -q clean integration-test install && 
dev-utilities/build-utils/verify_licenses.sh 
 ```
   
   - [X] Have you written or updated unit tests and or integration tests to 
verify your changes?
   - [X] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)?
   - [X] Have you verified the basic functionality of the build by building and 
running locally with Vagrant full-dev environment or the equivalent?
   
   ### For documentation related changes:
   - [X] Have you ensured that format looks appropriate for the output in which 
it is rendered by building and verifying the site-book? If not then run the 
following commands and the verify changes via 
`site-book/target/site/index.html`:
   
 ```
 cd site-book
 mvn site
 ```
   
    Note:
   Please ensure that once the PR is submitted, you check travis-ci for build 
issues and submit an update to your PR as soon as possible.
   It is also recommended that [travis-ci](https://travis-ci.org) is set up for 
your personal repository such that your branches are built there before 
submitting a pull request.
   


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[GitHub] MohanDV opened a new pull request #1333: METRON-1996 : Index search using group for Solr throws NPE if the group parameter is null

2019-02-08 Thread GitBox
MohanDV opened a new pull request #1333: METRON-1996 : Index search using group 
for Solr throws NPE if the group parameter is null
URL: https://github.com/apache/metron/pull/1333
 
 
   ## Contributor Comments
   Index search using group for Solr throws NPE if the group parameter is null, 
also returns no content message if the group list is empty.
   
   ## Pull Request Checklist
   Thank you for submitting a contribution to Apache Metron.  
   Please refer to our [Development 
Guidelines](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61332235)
 for the complete guide to follow for contributions.  
   Please refer also to our [Build Verification 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Verifying+Builds?show-miniview)
 for complete smoke testing guides.  
   
   
   In order to streamline the review of the contribution we ask you follow 
these guidelines and ask you to double check the following:
   
   ### For all changes:
   - [x] Is there a JIRA ticket associated with this PR? If not one needs to be 
created at [Metron 
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
   - [x] Does your PR title start with METRON- where  is the JIRA 
number you are trying to resolve? Pay particular attention to the hyphen "-" 
character.
   - [x] Has your PR been rebased against the latest commit within the target 
branch (typically master)?
   
   
   ### For code changes:
   - [] Have you included steps to reproduce the behavior or problem that is 
being changed or addressed?
   - [ ] Have you included steps or a guide to how the change may be verified 
and tested manually?
   - [ ] Have you ensured that the full suite of tests and checks have been 
executed in the root metron folder via:
 ```
 mvn -q clean integration-test install && 
dev-utilities/build-utils/verify_licenses.sh 
 ```
   
   - [ ] Have you written or updated unit tests and or integration tests to 
verify your changes?
   - [ ] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)?
   - [ ] Have you verified the basic functionality of the build by building and 
running locally with Vagrant full-dev environment or the equivalent?
   
   ### For documentation related changes:
   - [ ] Have you ensured that format looks appropriate for the output in which 
it is rendered by building and verifying the site-book? If not then run the 
following commands and the verify changes via 
`site-book/target/site/index.html`:
   
 ```
 cd site-book
 mvn site
 ```
   
    Note:
   Please ensure that once the PR is submitted, you check travis-ci for build 
issues and submit an update to your PR as soon as possible.
   It is also recommended that [travis-ci](https://travis-ci.org) is set up for 
your personal repository such that your branches are built there before 
submitting a pull request.
   


This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services


[jira] [Created] (METRON-1997) Replace Threat Triage Score Field Slider with Text Box

2019-02-08 Thread Tamas Fodor (JIRA)
Tamas Fodor created METRON-1997:
---

 Summary: Replace Threat Triage Score Field Slider with Text Box
 Key: METRON-1997
 URL: https://issues.apache.org/jira/browse/METRON-1997
 Project: Metron
  Issue Type: Improvement
Reporter: Tamas Fodor
Assignee: Tamas Fodor


As a first step, it would be great to have a numeric text field there instead 
of a slider because later we would like it to accept Stellar expressions.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[jira] [Created] (METRON-1996) Solr search throws NPE for group search if the group parameter is null or empty

2019-02-08 Thread Mohan (JIRA)
Mohan created METRON-1996:
-

 Summary: Solr search throws NPE for group search if the group 
parameter is null or empty
 Key: METRON-1996
 URL: https://issues.apache.org/jira/browse/METRON-1996
 Project: Metron
  Issue Type: Bug
Reporter: Mohan
Assignee: Mohan


/api/v1/search/search throws Null pointer exception if the groups parameter is 
null 

 
{code:java}
{ "scoreField": "threat.triage.score", "query": "*", "indices": ["bro", 
"snort"], "groups": null }
{code}
 
{code:java}
SEVERE: Servlet.service() for servlet [dispatcherServlet] in context with path 
[] threw exception [Request processing failed; nested exception is 
java.lang.NullPointerException] with root cause java.lang.NullPointerException 
at org.apache.metron.solr.dao.SolrSearchDao.group(SolrSearchDao.java:108) at 
org.apache.metron.solr.dao.SolrMetaAlertSearchDao.group(SolrMetaAlertSearchDao.java:213)
 at 
org.apache.metron.solr.dao.SolrMetaAlertDao.group(SolrMetaAlertDao.java:188) at 
org.apache.metron.rest.service.impl.SearchServiceImpl.group(SearchServiceImpl.java:105)
 at 
org.apache.metron.rest.controller.SearchController.group(SearchController.java:63)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498) at 
org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:209)
 at 
org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136)
 at 
org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
 at 
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:877)
 at 
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:783)
 at 
org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
 at 
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:991)
 at 
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:925)
 at 
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:974)
 at 
org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:877)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:661) at 
org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:851)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
 at 
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
 at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
 at 
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
 at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:320)
 at 
org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)
 at 
org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
 at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
 at 
org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)
 at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
 at 
org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
 at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
 at 
org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
 at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
 at 
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
 at 
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
 at 
org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
 at