[METRON-1247] REST search and findOne endpoints return unexpected or incorrect results for guids

• Type: Bug
• Status: Done
• Priority: Major
• Resolution: Done
• Fix Version/s: 0.4.2
• Assignee: Justin Leet
• Reporter: Justin Leet
• Created: 11/Oct/17 19:50
• Updated: 15/Dec/17 18:51
• Resolved: 16/Oct/17 23:20

Description

When running a search for a particular GUID, e.g.

{
  "indices": ["websphere", "snort", "asa", "bro", "yaf"],
  "query": "guid:a2d7ba04-d335-4948-8bc8-c889e7c531c9",
  "from": 0,
  "size": 500
}

Multiple results can be returned. This appears to be because the "guid" field gets the default analyzer, so the individual segments between the hyphens can match.

A workaround is simply to quote the string (escaping appropriately). This should be documented. A longer term solution is likely needed, but requires more discussion.

For findOne, the same situation happens, but since only one item is returned it can be incorrect (a partial match that happens to be sorted earlier). This should be changed to a simple GET against the id (which is also the guid by design). It's also more efficient to do this anyway.

Issue Links

• links to: GitHub Pull Request #798