[jira] [Created] (METRON-1220) Create documentation around alert nested field

["Justin Leet (JIRA)" <ji...@apache.org>]

Justin Leet created METRON-1220:
-----------------------------------

             Summary: Create documentation around alert nested field
                 Key: METRON-1220
                 URL: https://issues.apache.org/jira/browse/METRON-1220
             Project: Metron
          Issue Type: Improvement
            Reporter: Justin Leet
            Assignee: Justin Leet


There is an additional requirement around defining a sensor's fields in Elasticsearch as a result of the meta alert functionality resulting from Elasticsearch 2.x. This should be added to to the appropriate READMEs as needed.

Specifically the sensors must all define a field as such:
{code}
        "alert": {
          "type": "nested"
        }
{code}

This field is a dummy field used exclusively to make searches work (because an error will be thrown when a field is missing).
{code}
QueryParsingException[[nested] failed to find nested object under path [alert]];
{code}

As noted https://github.com/apache/metron/pull/619#issuecomment-330529609, this underlying ES behavior is changed with ES 5.x and a small modification to the query can be made and this field removed. This is documentd by ES at https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-sort.html#_ignoring_unmapped_fields



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)