[jira] [Commented] (METRON-401) ParseException Thrown by ThreatIntelJoinBolt

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/METRON-401?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15453575#comment-15453575 ] 

ASF GitHub Bot commented on METRON-401:
---------------------------------------

GitHub user nickwallen opened a pull request:

    https://github.com/apache/incubator-metron/pull/239

    METRON-401 ParseException Thrown by ThreatIntelJoinBolt

    If the configuration for the ThreatIntelJoinBolt used any Stellar code that called a function, the following error occured.
    
    ```
    org.apache.metron.common.dsl.ParseException: Unable to find string function IN_SUBNET.  Valid functions are...
    ```
    
    The `FunctionResolver` used by the `ThreatIntelJoinBolt` was not being initialized.  If the configuration included any function calls, the functions could not be resolved and a ParseException was thrown.  
    
    Configuration containing Stellar code that does not call any functions was not impacted.  This is why the existing unit and functional tests did not catch this.  Updated the unit tests to validate the fix.

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/nickwallen/incubator-metron METRON-401

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/incubator-metron/pull/239.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #239
    
----
commit 0da57e39107e370566e9ac35976c99517754a613
Author: Nick Allen <ni...@nickallen.org>
Date:   2016-08-31T22:21:12Z

    METRON-401 ParseException Thrown by ThreatIntelJoinBolt

----


> ParseException Thrown by ThreatIntelJoinBolt
> --------------------------------------------
>
>                 Key: METRON-401
>                 URL: https://issues.apache.org/jira/browse/METRON-401
>             Project: Metron
>          Issue Type: Bug
>            Reporter: Nick Allen
>            Assignee: Nick Allen
>
> Exception thrown by ThreatIntelJoinBolt with default Metron deployment.
> {code}
> org.apache.metron.common.dsl.ParseException: Unable to find string function IN_SUBNET.  Valid functions are TO_LOWER,TO_UPPER,TRIM,JOIN,SPLIT,GET_FIRST,GET_LAST,GET,STARTS_WITH,ENDS_WITH,REGEXP_MATCH,TO_STRING,TO_INTEGER,TO_DOUBLE,TO_LONG,MAP_GET,MAP_EXISTS,DOMAIN_TO_TLD,DOMAIN_REMOVE_TLD,DOMAIN_REMOVE_SUBDOMAINS,URL_TO_HOST,URL_TO_PORT,URL_TO_PATH,URL_TO_PROTOCOL,IN_SUBNET,PROTOCOL_TO_NAME,TO_EPOCH_TIMESTAMP,YEAR,MONTH,DAY_OF_MONTH,DAY_OF_WEEK,WEEK_OF_MONTH,WEEK_OF_YEAR,DAY_OF_YEAR,IS_EMPTY,IS_IP,IS_DOMAIN,IS_EMAIL,IS_URL,IS_DATE,IS_INTEGER,MAAS_GET_ENDPOINT,MODEL_APPLY,STATS_INIT,STATS_ADD,STATS_COUNT,STATS_MEAN,STATS_GEOMETRIC_MEAN,STATS_MAX,STATS_MIN,STATS_SUM,STATS_POPULATION_VARIANCE,STATS_VARIANCE,STATS_QUADRATIC_MEAN,STATS_SD,STATS_SUM_LOGS,STATS_SUM_SQUARES,STATS_KURTOSIS,STATS_SKEWNESS,STATS_PERCENTILE
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)