Uploaded image for project: 'Metron'
  1. Metron
  2. METRON-1660

On Solr, sorting by threat score fails

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Done
    • Priority: Major
    • Resolution: Done
    • Affects Version/s: None
    • Fix Version/s: 0.6.0
    • Labels:
      None

      Description

      • HCP 1.5.1.0 bld 16
      • 12-node Ubuntu 14.04 cluster on Openstack
      • Solr indexing server + Kerberized

      Steps to Reproduce
      1. Ingest snort events
      2. Create a metaalert using snort alerts
      3. Sort by 'Score'

      Following error is seen in REST API:

      {"responseCode":500,"message":"No live SolrServers available to handle this request:[http://nat-u14-jaks-metron-1.openstacklocal:8983/solr/metaalert_shard1_replica1, http://nat-u14-jaks-metron-1.openstacklocal:8983/solr/yaf_shard1_replica1]","fullMessage":"HttpSolrClient.RemoteSolrException: Error from server at http://nat-u14-jaks-metron-1.openstacklocal:8983/solr/metaalert_shard1_replica1: java.lang.Float cannot be cast to java.lang.String"}
      

      Following exceptions are seen in solr.log

      2018-07-09 09:41:25,817 [qtp705265961-18] ERROR [c:metaalert s:shard1 r:core_node1 x:metaalert_shard1_replica1] org.apache.solr.common.SolrException (SolrException.java:159) - null:java.lang.ClassCastException: java.lang.Float cannot be cast to java.lang.String
      	at org.apache.solr.schema.FieldType.unmarshalStringSortValue(FieldType.java:1100)
      	at org.apache.solr.schema.StrField.unmarshalSortValue(StrField.java:105)
      	at org.apache.solr.handler.component.QueryComponent.unmarshalSortValues(QueryComponent.java:1251)
      	at org.apache.solr.handler.component.QueryComponent.mergeIds(QueryComponent.java:1075)
      	at org.apache.solr.handler.component.QueryComponent.handleRegularResponses(QueryComponent.java:775)
      	at org.apache.solr.handler.component.QueryComponent.handleResponses(QueryComponent.java:754)
      	at org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:429)
      	at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:173)
      	at org.apache.solr.core.SolrCore.execute(SolrCore.java:2477)
      	at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:723)
      	at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:529)
      	at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:361)
      	at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:305)
      	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1691)
      	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:582)
      	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
      	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
      	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:226)
      	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1180)
      	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:512)
      	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
      	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1112)
      	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
      	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:213)
      	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:119)
      	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:134)
      	at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:335)
      	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:134)
      	at org.eclipse.jetty.server.Server.handle(Server.java:534)
      	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:320)
      	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
      	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:273)
      	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95)
      	at org.eclipse.jetty.io.SelectChannelEndPoint$2.run(SelectChannelEndPoint.java:93)
      	at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.executeProduceConsume(ExecuteProduceConsume.java:303)
      	at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceConsume(ExecuteProduceConsume.java:148)
      	at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:136)
      	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:671)
      	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:589)
      	at java.lang.Thread.run(Thread.java:745)
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                justinleet Justin Leet
                Reporter:
                justinleet Justin Leet
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: