Skip to content

percentage_match rule Kibana link generating wrong query #1450

Closed Locked Answered by jertel
aliosmanisikk asked this question in Q&A
Discussion options

You must be logged in to vote

Thanks for locating the specific release that broke.

@jmacdone, In PR #1330 the change to utils.py where it now trims the .keyword suffix from the lookup field is causing fields that have a keyword subfield to have the returned value to be a map containing a keyword key, as shown above, instead of returning the actual value.

Specifically, this change in #1330: https://github.com/jertel/elastalert2/pull/1330/files#diff-c94be3c6634086358da8944c7febe9c9e98fc1b4425fcc4e116e0740f5cf4eb6R88

The modified PR unit tests for that change don't directly test for this condition, where the field in the match has a nested dict with a keyword key. If a new unit test is added such as below, the test fails:

Replies: 1 comment 13 replies

Comment options

You must be logged in to vote
13 replies
@jertel
Comment options

@aliosmanisikk
Comment options

@aliosmanisikk
Comment options

@jertel
Comment options

Answer selected by aliosmanisikk
@jmacdone
Comment options

@jmacdone
Comment options

@aliosmanisikk
Comment options

@jertel
Comment options

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
3 participants