You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@metron.apache.org by nickwallen <gi...@git.apache.org> on 2017/10/23 19:29:08 UTC

[GitHub] metron issue #811: METRON-1272: Hide child alerts from searches and grouping...

Github user nickwallen commented on the issue:

    https://github.com/apache/metron/pull/811
  
    It appears to me that the alerts contained within a meta-alert are not contributing to the facet counts returned by a search request.  I think we still do want that to happen.  Let me explain with an example and screenshots.
    
    Note: I am testing this together with the UI changes in #803 .
    
    1. First, I isolate 10 alerts with a specific host name that I want to work with.  I have turned off ingest so that no additional alerts should appear during the running of this example.  I can see that the facet counts are what I would expect.
    
    ![screen shot 2017-10-23 at 3 01 45 pm](https://user-images.githubusercontent.com/2475409/31908592-6de23998-b805-11e7-8201-c9983bfdc476.png)
    
    2. Next, I group by host so that I can create my meta-alert.
    
    ![screen shot 2017-10-23 at 3 01 58 pm](https://user-images.githubusercontent.com/2475409/31908646-97cf304e-b805-11e7-9ca4-14bb0269fc0c.png)
    
    ![screen shot 2017-10-23 at 3 02 09 pm](https://user-images.githubusercontent.com/2475409/31908665-a1bea3e6-b805-11e7-96e1-572faaf38e7a.png)
    
    3. Immediately after creating the meta-alert, I do not immediately see it.  I think this is a problem with the UI itself not refreshing after creating the alert.  This might need fixed in #803 .
    
    ![screen shot 2017-10-23 at 3 02 37 pm](https://user-images.githubusercontent.com/2475409/31908754-edf3aebe-b805-11e7-86ff-838a1572a27d.png)
    
    4. If I then trigger another search, I do see the meta-alert.  Great!
    
    ![screen shot 2017-10-23 at 3 03 14 pm](https://user-images.githubusercontent.com/2475409/31908976-a74e13cc-b806-11e7-860b-8a86aac8d36a.png)
    
    5. Next I just expand the meta-alert to validate that the 10 original alerts were added.  You can see from this screenshot that the facet counts all show 0.  This tells me that the facet counts are not including meta-alerts.
    
    ![screen shot 2017-10-23 at 3 08 55 pm](https://user-images.githubusercontent.com/2475409/31909047-d7384738-b806-11e7-8a88-8391be7a2807.png)
    
    



---