You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@metron.apache.org by Dima Kovalyov <Di...@sstech.us> on 2017/08/02 19:53:08 UTC
profiler Syntax error
Hello Metron dev,
I have created profile:
{
"profile": "host-talks-to",
"onlyif": "exists(source_ip)",
"foreach": "source_ip",
"init": {
"in": "HLLP_INIT(5, 6)"
},
"update": { "in": "HLLP_ADD(in, destination_ip)" },
"result": "HLLP_CARDINALITY(in)"
}
And when I stream in data to it, I receive following error:
org.apache.metron.common.dsl.ParseException: Bad 'update' expression: Unable to parse: HLLP_ADD(in, destination_ip) due to: org.apache.metron.common.dsl.ParseException: Syntax error @ 1:9 no viable alternative at input 'HLLP_ADD(in', profile=host-talks-to, entity=System.Collections.Generic.KeyValuePair`2[System.String,System.Object][] at
From builderBolt in profiler and:
java.lang.OutOfMemoryError: GC overhead limit exceeded at java.util.Arrays.copyOfRange(Arrays.java:3664) at java.lang.StringBuffer.toString(StringBuffer.java:671) at org.json.simple.parser.Yylex.yylex(Yylex.java:598) at
Can you please help figure where the syntax is broken? I can't figure it out as it is the same as in:
https://github.com/hortonworks-gallery/metron-rules/blob/master/use-cases/DegreeOfHost/profile.json
Thank you!
- Dima
Re: profiler Syntax error
Posted by Matt Foley <mf...@hortonworks.com>.
Good eye, Otto!
From: Otto Fowler <ot...@gmail.com>
Date: Wednesday, August 2, 2017 at 2:12 PM
To: Matt Foley <mf...@hortonworks.com>, "dev@metron.apache.org" <de...@metron.apache.org>, "user@metron.apache.org" <us...@metron.apache.org>
Subject: Re: profiler Syntax error
Can you try the rule without ‘in’ as a key?
“in” is a reserved word in Stellar.
What that error means is that the ANTLR lexer and parser cannot figure out what the statement means because of ambiguity, most likely introduced by the use of a keyword. (in is not a valid statement.
On August 2, 2017 at 16:49:49, Matt Foley (mfoley@hortonworks.com<ma...@hortonworks.com>) wrote:
Unable to pars
Re: profiler Syntax error
Posted by Dima Kovalyov <Di...@sstech.us>.
That is excellent Otto, thank you very much for suggestion, it worked.
I have these errors in elasticsearch error_index: error_1.txt and error_2.txt
Maybe this is something you can crack also?
Appreciate your help!
- Dima
On 08/03/2017 04:17 AM, Otto Fowler wrote:
[Stellar]>>> in:= 'foo'
[Stellar]>>> TO_UPPER(in)
[!] Unable to parse: TO_UPPER(in) due to: org.apache.metron.stellar.dsl.ParseException: Syntax error @ 1:9 no viable alternative at input 'TO_UPPER(in'
org.apache.metron.stellar.dsl.ParseException: Unable to parse: TO_UPPER(in) due to: org.apache.metron.stellar.dsl.ParseException: Syntax error @ 1:9 no viable alternative at input 'TO_UPPER(in'
On August 2, 2017 at 17:12:27, Otto Fowler (ottobackwards@gmail.com<ma...@gmail.com>) wrote:
Can you try the rule without ‘in’ as a key?
“in” is a reserved word in Stellar.
What that error means is that the ANTLR lexer and parser cannot figure out what the statement means because of ambiguity, most likely introduced by the use of a keyword. (in is not a valid statement.
On August 2, 2017 at 16:49:49, Matt Foley (mfoley@hortonworks.com<ma...@hortonworks.com>) wrote:
Unable to pars
Re: profiler Syntax error
Posted by Dima Kovalyov <Di...@sstech.us>.
That is excellent Otto, thank you very much for suggestion, it worked.
I have these errors in elasticsearch error_index: error_1.txt and error_2.txt
Maybe this is something you can crack also?
Appreciate your help!
- Dima
On 08/03/2017 04:17 AM, Otto Fowler wrote:
[Stellar]>>> in:= 'foo'
[Stellar]>>> TO_UPPER(in)
[!] Unable to parse: TO_UPPER(in) due to: org.apache.metron.stellar.dsl.ParseException: Syntax error @ 1:9 no viable alternative at input 'TO_UPPER(in'
org.apache.metron.stellar.dsl.ParseException: Unable to parse: TO_UPPER(in) due to: org.apache.metron.stellar.dsl.ParseException: Syntax error @ 1:9 no viable alternative at input 'TO_UPPER(in'
On August 2, 2017 at 17:12:27, Otto Fowler (ottobackwards@gmail.com<ma...@gmail.com>) wrote:
Can you try the rule without ‘in’ as a key?
“in” is a reserved word in Stellar.
What that error means is that the ANTLR lexer and parser cannot figure out what the statement means because of ambiguity, most likely introduced by the use of a keyword. (in is not a valid statement.
On August 2, 2017 at 16:49:49, Matt Foley (mfoley@hortonworks.com<ma...@hortonworks.com>) wrote:
Unable to pars
Re: profiler Syntax error
Posted by Otto Fowler <ot...@gmail.com>.
[Stellar]>>> in:= 'foo'
[Stellar]>>> TO_UPPER(in)
[!] Unable to parse: TO_UPPER(in) due to:
org.apache.metron.stellar.dsl.ParseException: Syntax error @ 1:9 no
viable alternative at input 'TO_UPPER(in'
org.apache.metron.stellar.dsl.ParseException: Unable to parse:
TO_UPPER(in) due to: org.apache.metron.stellar.dsl.ParseException:
Syntax error @ 1:9 no viable alternative at input 'TO_UPPER(in'
On August 2, 2017 at 17:12:27, Otto Fowler (ottobackwards@gmail.com) wrote:
Can you try the rule without ‘in’ as a key?
“in” is a reserved word in Stellar.
What that error means is that the ANTLR lexer and parser cannot figure out
what the statement means because of ambiguity, most likely introduced by
the use of a keyword. (in is not a valid statement.
On August 2, 2017 at 16:49:49, Matt Foley (mfoley@hortonworks.com) wrote:
Unable to pars
Re: profiler Syntax error
Posted by Matt Foley <mf...@hortonworks.com>.
Good eye, Otto!
From: Otto Fowler <ot...@gmail.com>
Date: Wednesday, August 2, 2017 at 2:12 PM
To: Matt Foley <mf...@hortonworks.com>, "dev@metron.apache.org" <de...@metron.apache.org>, "user@metron.apache.org" <us...@metron.apache.org>
Subject: Re: profiler Syntax error
Can you try the rule without ‘in’ as a key?
“in” is a reserved word in Stellar.
What that error means is that the ANTLR lexer and parser cannot figure out what the statement means because of ambiguity, most likely introduced by the use of a keyword. (in is not a valid statement.
On August 2, 2017 at 16:49:49, Matt Foley (mfoley@hortonworks.com<ma...@hortonworks.com>) wrote:
Unable to pars
Re: profiler Syntax error
Posted by Otto Fowler <ot...@gmail.com>.
[Stellar]>>> in:= 'foo'
[Stellar]>>> TO_UPPER(in)
[!] Unable to parse: TO_UPPER(in) due to:
org.apache.metron.stellar.dsl.ParseException: Syntax error @ 1:9 no
viable alternative at input 'TO_UPPER(in'
org.apache.metron.stellar.dsl.ParseException: Unable to parse:
TO_UPPER(in) due to: org.apache.metron.stellar.dsl.ParseException:
Syntax error @ 1:9 no viable alternative at input 'TO_UPPER(in'
On August 2, 2017 at 17:12:27, Otto Fowler (ottobackwards@gmail.com) wrote:
Can you try the rule without ‘in’ as a key?
“in” is a reserved word in Stellar.
What that error means is that the ANTLR lexer and parser cannot figure out
what the statement means because of ambiguity, most likely introduced by
the use of a keyword. (in is not a valid statement.
On August 2, 2017 at 16:49:49, Matt Foley (mfoley@hortonworks.com) wrote:
Unable to pars
Re: profiler Syntax error
Posted by Otto Fowler <ot...@gmail.com>.
Can you try the rule without ‘in’ as a key?
“in” is a reserved word in Stellar.
What that error means is that the ANTLR lexer and parser cannot figure out
what the statement means because of ambiguity, most likely introduced by
the use of a keyword. (in is not a valid statement.
On August 2, 2017 at 16:49:49, Matt Foley (mfoley@hortonworks.com) wrote:
Unable to pars
Re: profiler Syntax error
Posted by Otto Fowler <ot...@gmail.com>.
Can you try the rule without ‘in’ as a key?
“in” is a reserved word in Stellar.
What that error means is that the ANTLR lexer and parser cannot figure out
what the statement means because of ambiguity, most likely introduced by
the use of a keyword. (in is not a valid statement.
On August 2, 2017 at 16:49:49, Matt Foley (mfoley@hortonworks.com) wrote:
Unable to pars
Re: profiler Syntax error
Posted by Matt Foley <mf...@hortonworks.com>.
Hi Dima,
Is it possible that the input parser is giving an unreasonable value for “destination_ip”? Or perhaps fails to provide an end quote for that value? Does this profile fail on the first message to be consumed, or does it get a ways into the data stream and then choke? In either case, can you look at a data dump to see whether the JSON metadata provides a reasonable-looking “destination_ip” value?
--Matt
From: Dima Kovalyov <Di...@sstech.us>
Reply-To: "user@metron.apache.org" <us...@metron.apache.org>
Date: Wednesday, August 2, 2017 at 12:53 PM
To: "dev@metron.apache.org" <de...@metron.apache.org>, "user@metron.apache.org" <us...@metron.apache.org>
Subject: profiler Syntax error
Hello Metron dev,
I have created profile:
{
"profile": "host-talks-to",
"onlyif": "exists(source_ip)",
"foreach": "source_ip",
"init": {
"in": "HLLP_INIT(5, 6)"
},
"update": { "in": "HLLP_ADD(in, destination_ip)" },
"result": "HLLP_CARDINALITY(in)"
}
And when I stream in data to it, I receive following error:
org.apache.metron.common.dsl.ParseException: Bad 'update' expression: Unable to parse: HLLP_ADD(in, destination_ip) due to: org.apache.metron.common.dsl.ParseException: Syntax error @ 1:9 no viable alternative at input 'HLLP_ADD(in', profile=host-talks-to, entity=System.Collections.Generic.KeyValuePair`2[System.String,System.Object][] at
From builderBolt in profiler and:
java.lang.OutOfMemoryError: GC overhead limit exceeded at java.util.Arrays.copyOfRange(Arrays.java:3664) at java.lang.StringBuffer.toString(StringBuffer.java:671) at org.json.simple.parser.Yylex.yylex(Yylex.java:598) at
Can you please help figure where the syntax is broken? I can't figure it out as it is the same as in:
https://github.com/hortonworks-gallery/metron-rules/blob/master/use-cases/DegreeOfHost/profile.json
Thank you!
- Dima
Re: profiler Syntax error
Posted by Matt Foley <mf...@hortonworks.com>.
Hi Dima,
Is it possible that the input parser is giving an unreasonable value for “destination_ip”? Or perhaps fails to provide an end quote for that value? Does this profile fail on the first message to be consumed, or does it get a ways into the data stream and then choke? In either case, can you look at a data dump to see whether the JSON metadata provides a reasonable-looking “destination_ip” value?
--Matt
From: Dima Kovalyov <Di...@sstech.us>
Reply-To: "user@metron.apache.org" <us...@metron.apache.org>
Date: Wednesday, August 2, 2017 at 12:53 PM
To: "dev@metron.apache.org" <de...@metron.apache.org>, "user@metron.apache.org" <us...@metron.apache.org>
Subject: profiler Syntax error
Hello Metron dev,
I have created profile:
{
"profile": "host-talks-to",
"onlyif": "exists(source_ip)",
"foreach": "source_ip",
"init": {
"in": "HLLP_INIT(5, 6)"
},
"update": { "in": "HLLP_ADD(in, destination_ip)" },
"result": "HLLP_CARDINALITY(in)"
}
And when I stream in data to it, I receive following error:
org.apache.metron.common.dsl.ParseException: Bad 'update' expression: Unable to parse: HLLP_ADD(in, destination_ip) due to: org.apache.metron.common.dsl.ParseException: Syntax error @ 1:9 no viable alternative at input 'HLLP_ADD(in', profile=host-talks-to, entity=System.Collections.Generic.KeyValuePair`2[System.String,System.Object][] at
From builderBolt in profiler and:
java.lang.OutOfMemoryError: GC overhead limit exceeded at java.util.Arrays.copyOfRange(Arrays.java:3664) at java.lang.StringBuffer.toString(StringBuffer.java:671) at org.json.simple.parser.Yylex.yylex(Yylex.java:598) at
Can you please help figure where the syntax is broken? I can't figure it out as it is the same as in:
https://github.com/hortonworks-gallery/metron-rules/blob/master/use-cases/DegreeOfHost/profile.json
Thank you!
- Dima