You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2017/02/01 03:15:52 UTC
[jira] [Commented] (METRON-680) GeoLiteDatabase incorrectly using
country geoname_id instead of city
[ https://issues.apache.org/jira/browse/METRON-680?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15847914#comment-15847914 ]
ASF GitHub Bot commented on METRON-680:
---------------------------------------
GitHub user justinleet opened a pull request:
https://github.com/apache/incubator-metron/pull/431
METRON-680: GeoLiteDatabase incorrectly using country geoname_id instead of city
See the discussion [METRON-680]( https://issues.apache.org/jira/browse/METRON-680) for more info. This implements the easy country -> city change. The two fields have the exact same format (they're both ids from geonames.org)
The main concern I have is what happens given that that the "Unique-Location(s)" visualization in Kibana uses locId directly. Changing what gets passed to it affects what shows up in that field.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/justinleet/incubator-metron METRON-680
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/incubator-metron/pull/431.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #431
----
commit 8cd13f44d9c23c6355f21f46284a42ddf55885f9
Author: justinjleet <ju...@gmail.com>
Date: 2017-02-01T03:07:31Z
METRON-680: GeoLiteDatabase incorrectly using country geoname_id instead of city
----
> GeoLiteDatabase incorrectly using country geoname_id instead of city
> --------------------------------------------------------------------
>
> Key: METRON-680
> URL: https://issues.apache.org/jira/browse/METRON-680
> Project: Metron
> Issue Type: Bug
> Reporter: Justin Leet
> Assignee: Justin Leet
> Priority: Minor
>
> Due to misunderstanding exactly how things tied together with the updated database, the wrong field is used for the locId. Instead of using the city's geoname_id, we are using the country's.
> This will effect Kibana dashboards and anything that depends on the locId, because it will be retrieved at the country level instead of the city level. The change will not break anything (anything not at the city level uses the country's code, e.g. if the IP is for Japan in general, the city code is 1861060, not empty or null). This example from the plaintext database can be seen in the second and third fields at:
> bq. 1.112.0.0/15,1861060,1861060,,0,0,,35.6900,139.6900,500
> The offending code is in `GeoLiteDatabase.java` and should be
> `geoInfo.put("locID", convertNullToEmptyString(country.getGeoNameId()));`
> This should be updated to grab the city's geoname, and tests should be updated to reflect this (they didn't catch this error because of the misunderstood data change, not an error in coding).
> Ideally, this field is renamed and better documented as part of METRON-679
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)