[METRON-1158] Build backend for grouping alerts into meta alerts

• Type: New Feature
• Status: Done
• Priority: Major
• Resolution: Done
• Fix Version/s: 0.4.2
• Assignee: Justin Leet
• Reporter: Justin Leet
• Created: 06/Sep/17 13:59
• Updated: 15/Dec/17 19:05
• Resolved: 15/Dec/17 19:05

Description

We should be able to handle meta alerts (manually grouped alerts, particularly from the UI) in the system. This should be integrated with the DAO composition put into place with IndexDao.

While similar to faceting (and likely resulting from slicing and dicing from faceting), these need to be interacted with and queryable alongside regular alerts.

This needs to handle:

• ES (as a starting point. This shouldn't preclude Solr)
• Creation of meta alerts
• Maintain update semantics for alerts
• Handling scores when a child alert is added, updated or deleted.
• Continue to allow regular alerts to flow through cleanly to the original sensor indices.
• Allow for querying (plus sorting and so on) alongside the original sensor indices.
• Maintain UI grouping order as the minimum of metadata.
• This should be configured via the same indexDao definition (or at least similar) as the other indexDaos.

Issue Links

• links to: GitHub Pull Request #734
• links to: GitHub Pull Request #803