[METRON-1565] Metaalerts fix denormalization after moving to active status

• Type: Bug
• Status: Done
• Priority: Major
• Resolution: Done
• Fix Version/s: 0.5.0
• Assignee: Ryan Merriman
• Reporter: Ryan Merriman
• Created: 15/May/18 21:35
• Updated: 23/May/18 16:15
• Resolved: 23/May/18 16:15

Description

The process of updating from inactive to active is slightly incomplete. Check out https://github.com/apache/metron/pull/970/files#diff-b7359d01c3ffbed48b7fdaa2d32169e7R246.

Say we have these three steps:

• Metaalert is updated to inactive
• (Former) child alert is updated.
• Metaalert is made active again.

The update will be missing from the metaalert. We need to update the metaalert with the current state of any alerts (which we conveniently have because we needed to update them all anyway!). This is a problem with both ES and Solr (which shouldn't be surprising since that link is to the abstract DAO). Basically, this should just be adding all the alerts in the metaalert back into the updated version of the document before passing it to the update. It also needs an associated test case.

This fix should be made against master and pulled into the Solr branch (and the metaalerts PR afterwards). See https://github.com/apache/metron/blob/e59059bd9707a6ca46c4137d796b8f2943f06b43/metron-platform/metron-elasticsearch/src/main/java/org/apache/metron/elasticsearch/dao/ElasticsearchMetaAlertDao.java#L351. Main thing might just be reordering the class to build the metaalert update itself after grabbing all the alerts.

Issue Links

• links to: GitHub Pull Request #1017