From 7736ae4e7e1c8d3d4be34f8e360eddea53c49d2c Mon Sep 17 00:00:00 2001 From: Andrey Fedorov Date: Mon, 21 Oct 2019 22:13:16 -0700 Subject: [PATCH] Fixes bug in AQR Alert columns with value NULL::STRING cause errors in Jira handler --- src/runners/alert_queries_runner.py | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/src/runners/alert_queries_runner.py b/src/runners/alert_queries_runner.py index a7437cd28..bcc5675e7 100755 --- a/src/runners/alert_queries_runner.py +++ b/src/runners/alert_queries_runner.py @@ -24,20 +24,20 @@ SELECT OBJECT_CONSTRUCT( 'ALERT_ID', UUID_STRING(), 'QUERY_NAME', '{{query_name}}', - 'QUERY_ID', IFNULL(QUERY_ID, PARSE_JSON('null')), - 'ENVIRONMENT', IFNULL(ENVIRONMENT, PARSE_JSON('null')), - 'SOURCES', IFNULL(SOURCES, PARSE_JSON('null')), - 'ACTOR', IFNULL(ACTOR, PARSE_JSON('null')), - 'OBJECT', IFNULL(OBJECT, PARSE_JSON('null')), - 'ACTION', IFNULL(ACTION, PARSE_JSON('null')), - 'TITLE', IFNULL(TITLE, PARSE_JSON('null')), - 'EVENT_TIME', IFNULL(EVENT_TIME, PARSE_JSON('null')), - 'ALERT_TIME', IFNULL(ALERT_TIME, PARSE_JSON('null')), - 'DESCRIPTION', IFNULL(DESCRIPTION, PARSE_JSON('null')), - 'DETECTOR', IFNULL(DETECTOR, PARSE_JSON('null')), - 'EVENT_DATA', IFNULL(EVENT_DATA, PARSE_JSON('null')), - 'SEVERITY', IFNULL(SEVERITY, PARSE_JSON('null')), - 'HANDLERS', IFNULL(OBJECT_CONSTRUCT(*):HANDLERS, PARSE_JSON('null')) + 'QUERY_ID', IFNULL(QUERY_ID::VARIANT, PARSE_JSON('null')), + 'ENVIRONMENT', IFNULL(ENVIRONMENT::VARIANT, PARSE_JSON('null')), + 'SOURCES', IFNULL(SOURCES::VARIANT, PARSE_JSON('null')), + 'ACTOR', IFNULL(ACTOR::VARIANT, PARSE_JSON('null')), + 'OBJECT', IFNULL(OBJECT::VARIANT, PARSE_JSON('null')), + 'ACTION', IFNULL(ACTION::VARIANT, PARSE_JSON('null')), + 'TITLE', IFNULL(TITLE::VARIANT, PARSE_JSON('null')), + 'EVENT_TIME', IFNULL(EVENT_TIME::VARIANT, PARSE_JSON('null')), + 'ALERT_TIME', IFNULL(ALERT_TIME::VARIANT, PARSE_JSON('null')), + 'DESCRIPTION', IFNULL(DESCRIPTION::VARIANT, PARSE_JSON('null')), + 'DETECTOR', IFNULL(DETECTOR::VARIANT, PARSE_JSON('null')), + 'EVENT_DATA', IFNULL(EVENT_DATA::VARIANT, PARSE_JSON('null')), + 'SEVERITY', IFNULL(SEVERITY::VARIANT, PARSE_JSON('null')), + 'HANDLERS', IFNULL(OBJECT_CONSTRUCT(*):HANDLERS::VARIANT, PARSE_JSON('null')) ) AS alert , alert_time , event_time