metron-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Matt Foley <>
Subject Re: profiler Syntax error
Date Wed, 02 Aug 2017 20:49:39 GMT
Hi Dima,
Is it possible that the input parser is giving an unreasonable value for “destination_ip”?
 Or perhaps fails to provide an end quote for that value?  Does this profile fail on the first
message to be consumed, or does it get a ways into the data stream and then choke?  In either
case, can you look at a data dump to see whether the JSON metadata provides a reasonable-looking
“destination_ip” value?


From: Dima Kovalyov <>
Reply-To: "" <>
Date: Wednesday, August 2, 2017 at 12:53 PM
To: "" <>, "" <>
Subject: profiler Syntax error

Hello Metron dev,

I have created profile:

  "profile": "host-talks-to",
  "onlyif": "exists(source_ip)",
  "foreach": "source_ip",
  "init": {
    "in": "HLLP_INIT(5, 6)"
  "update": { "in": "HLLP_ADD(in, destination_ip)" },
  "result": "HLLP_CARDINALITY(in)"
And when I stream in data to it, I receive following error:

org.apache.metron.common.dsl.ParseException: Bad 'update' expression: Unable to parse: HLLP_ADD(in,
destination_ip) due to: org.apache.metron.common.dsl.ParseException: Syntax error @ 1:9 no
viable alternative at input 'HLLP_ADD(in', profile=host-talks-to, entity=System.Collections.Generic.KeyValuePair`2[System.String,System.Object][]
From builderBolt in profiler and:

java.lang.OutOfMemoryError: GC overhead limit exceeded at java.util.Arrays.copyOfRange(
at java.lang.StringBuffer.toString( at org.json.simple.parser.Yylex.yylex(

Can you please help figure where the syntax is broken? I can't figure it out as it is the
same as in:

Thank you!

- Dima

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message