[METRON-1660] On Solr, sorting by threat score fails

• Type: Bug
• Status: Done
• Priority: Major
• Resolution: Done
• Fix Version/s: 0.6.0
• Assignee: Justin Leet
• Reporter: Justin Leet
• Created: 10/Jul/18 17:13
• Updated: 05/Sep/18 15:20
• Resolved: 05/Sep/18 15:20

Description

• HCP 1.5.1.0 bld 16
• 12-node Ubuntu 14.04 cluster on Openstack
• Solr indexing server + Kerberized

Steps to Reproduce
1. Ingest snort events
2. Create a metaalert using snort alerts
3. Sort by 'Score'

Following error is seen in REST API:

{"responseCode":500,"message":"No live SolrServers available to handle this request:[http://nat-u14-jaks-metron-1.openstacklocal:8983/solr/metaalert_shard1_replica1, http://nat-u14-jaks-metron-1.openstacklocal:8983/solr/yaf_shard1_replica1]","fullMessage":"HttpSolrClient.RemoteSolrException: Error from server at http://nat-u14-jaks-metron-1.openstacklocal:8983/solr/metaalert_shard1_replica1: java.lang.Float cannot be cast to java.lang.String"}

Following exceptions are seen in solr.log

2018-07-09 09:41:25,817 [qtp705265961-18] ERROR [c:metaalert s:shard1 r:core_node1 x:metaalert_shard1_replica1] org.apache.solr.common.SolrException (SolrException.java:159) - null:java.lang.ClassCastException: java.lang.Float cannot be cast to java.lang.String
	at org.apache.solr.schema.FieldType.unmarshalStringSortValue(FieldType.java:1100)
	at org.apache.solr.schema.StrField.unmarshalSortValue(StrField.java:105)
	at org.apache.solr.handler.component.QueryComponent.unmarshalSortValues(QueryComponent.java:1251)
	at org.apache.solr.handler.component.QueryComponent.mergeIds(QueryComponent.java:1075)
	at org.apache.solr.handler.component.QueryComponent.handleRegularResponses(QueryComponent.java:775)
	at org.apache.solr.handler.component.QueryComponent.handleResponses(QueryComponent.java:754)
	at org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:429)
	at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:173)
	at org.apache.solr.core.SolrCore.execute(SolrCore.java:2477)
	at org.apache.solr.servlet.HttpSolrCall.execute(HttpSolrCall.java:723)
	at org.apache.solr.servlet.HttpSolrCall.call(HttpSolrCall.java:529)
	at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:361)
	at org.apache.solr.servlet.SolrDispatchFilter.doFilter(SolrDispatchFilter.java:305)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1691)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:582)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:226)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1180)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:512)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1112)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:213)
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:119)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:134)
	at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:335)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:134)
	at org.eclipse.jetty.server.Server.handle(Server.java:534)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:320)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:273)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95)
	at org.eclipse.jetty.io.SelectChannelEndPoint$2.run(SelectChannelEndPoint.java:93)
	at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.executeProduceConsume(ExecuteProduceConsume.java:303)
	at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceConsume(ExecuteProduceConsume.java:148)
	at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:136)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:671)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:589)
	at java.lang.Thread.run(Thread.java:745)

Issue Links

• links to: GitHub Pull Request #1102