Details
-
Bug
-
Status: Done
-
Minor
-
Resolution: Done
-
None
-
None
Description
Due to misunderstanding exactly how things tied together with the updated database, the wrong field is used for the locId. Instead of using the city's geoname_id, we are using the country's.
This will effect Kibana dashboards and anything that depends on the locId, because it will be retrieved at the country level instead of the city level. The change will not break anything (anything not at the city level uses the country's code, e.g. if the IP is for Japan in general, the city code is 1861060, not empty or null). This example from the plaintext database can be seen in the second and third fields at:
1.112.0.0/15,1861060,1861060,,0,0,,35.6900,139.6900,500
The offending code is in `GeoLiteDatabase.java` and should be
`geoInfo.put("locID", convertNullToEmptyString(country.getGeoNameId()));`
This should be updated to grab the city's geoname, and tests should be updated to reflect this (they didn't catch this error because of the misunderstood data change, not an error in coding).
Ideally, this field is renamed and better documented as part of METRON-679
