You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@metron.apache.org by Tibor Meller <ti...@gmail.com> on 2019/06/03 15:13:26 UTC

Re: [DISCUSS] Bug maybe: Alert UI can't use two status filter

Thanks for the answers!
Ticket created: https://issues.apache.org/jira/browse/METRON-2150
I start working on it bc it bocking me.

On Fri, May 31, 2019 at 9:43 PM Michael Miklavcic <
michael.miklavcic@gmail.com> wrote:

> Can you log a Jira for this Tibor?
>
> On Fri, May 31, 2019 at 1:22 PM Otto Fowler <ot...@gmail.com>
> wrote:
>
> > Bug
> >
> >
> > On May 31, 2019 at 08:53:21, Tibor Meller (tibor.meller@gmail.com)
> wrote:
> >
> > Hi all,
> >
> > tl;dr: Is it a bug if "* -alert_status:RESOLVE OR -alert_status:DISMISS"
> > not works on Alert UI?
> >
> > I'm experimenting with filtering from the alert UI. What I found is I can
> > run the following query directly against the REST API without any
> problem:
> > "* -alert_status:RESOLVE OR -alert_status:DISMISS"
> > But if I try to add the same filter on the Alert UI only the
> > alert_status:DISMISS applies to the query.
> > The reason is we identifying filters by filter.field so two filters to
> the
> > same filed (alert_status in this case) override each other.
> >
> > Is this a bug? If it is, I'm happy to fix it.
> >
> > Regards,
> > Tibor
> >
>

Re: [DISCUSS] Bug maybe: Alert UI can't use two status filter

Posted by Tibor Meller <ti...@gmail.com>.
Hi all,

I just opened a PR for fixing filtering in Alerts UI. I found a few other
use cases which haven't worked as expected.
https://github.com/apache/metron/pull/1443

Regards,
Tibor

On Mon, Jun 3, 2019 at 5:13 PM Tibor Meller <ti...@gmail.com> wrote:

> Thanks for the answers!
> Ticket created: https://issues.apache.org/jira/browse/METRON-2150
> I start working on it bc it bocking me.
>
> On Fri, May 31, 2019 at 9:43 PM Michael Miklavcic <
> michael.miklavcic@gmail.com> wrote:
>
>> Can you log a Jira for this Tibor?
>>
>> On Fri, May 31, 2019 at 1:22 PM Otto Fowler <ot...@gmail.com>
>> wrote:
>>
>> > Bug
>> >
>> >
>> > On May 31, 2019 at 08:53:21, Tibor Meller (tibor.meller@gmail.com)
>> wrote:
>> >
>> > Hi all,
>> >
>> > tl;dr: Is it a bug if "* -alert_status:RESOLVE OR -alert_status:DISMISS"
>> > not works on Alert UI?
>> >
>> > I'm experimenting with filtering from the alert UI. What I found is I
>> can
>> > run the following query directly against the REST API without any
>> problem:
>> > "* -alert_status:RESOLVE OR -alert_status:DISMISS"
>> > But if I try to add the same filter on the Alert UI only the
>> > alert_status:DISMISS applies to the query.
>> > The reason is we identifying filters by filter.field so two filters to
>> the
>> > same filed (alert_status in this case) override each other.
>> >
>> > Is this a bug? If it is, I'm happy to fix it.
>> >
>> > Regards,
>> > Tibor
>> >
>>
>