[jira] [Updated] (METRON-567) Usernames as numerics strings attempted to be parsed and compared as numbers

["Prashant Bhalesain (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/METRON-567?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Prashant Bhalesain updated METRON-567:
--------------------------------------
    Attachment: metron-567.zip

Attached is a sample test we ran that could reproduce the same results. If the user name is mixed with numbers and strings it fails to enrich the data with numeric usernames.
Attached is:
1. extractor config.
2. enrichment config and data
3. telemetry sampel data
4. grok parser
5. Stacktrace. and all the supporting files to reproduce the isse.

> Usernames as numerics strings attempted to be parsed and compared as numbers
> ----------------------------------------------------------------------------
>
>                 Key: METRON-567
>                 URL: https://issues.apache.org/jira/browse/METRON-567
>             Project: Metron
>          Issue Type: Bug
>    Affects Versions: 0.2.1BETA
>         Environment: Linux CentOS 6.5
> 252GB RAM
> HDP 2.5
> 16TB HDD
>            Reporter: ed de
>            Priority: Minor
>         Attachments: metron-567.zip
>
>
> 1. Windows logs are being ingested through Nifi, most usernames are number (ex: 423191384) 
> 2. Windows parser Grok pattern for element "usrName" has been modified to and from : GREEDYDATA, NUMBER, WORD, USERNAME.
> 3. An enrichment has been flatline loaded into Hbase containing department, manager, firstname, lastname, etc.
> 4. The enrichment works if the usrName is characters (ex: DONALDDUCK)
> 5. The consistent error message is "cannot cast java.lang.Long to java.lang.String". This is readily apparent in the enrichment log under /var/log/storm/enrichment*
> To recreate, build a parser that looks for a username, then build a simple enrichment, then feed a sample of numeric and non-numeric username logs through the system and see which one parses and enriches. 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)