Details
-
Bug
-
Resolution: Done
-
Major
-
3.1-m1
-
None
Description
Guys, repeating a query from someone who perhaps didn't write it that clearly (chinese):
If they try the following condition:
varclu : cluster(clusterid==v_cluster
_id, transitionid==v_transition, stateid==v_state,ruleid==v_rule_id, v_evtid : evtid, v_evttype : evttype, v_srcaddress : srcaddress, v_destaddress : destaddress, v_timestamp : timestamp, v_alertid : alertid)" .
It blows up with "There cannot be more than 3 indexes"
Which is due to QuadroupleBetaConstraints not dealing with that many indexes.
When he deletes one equality ,such as "ruleid==v_rule_id", and then add "eval(varclu.getRuleid()==v_rule_id)", it works - so it looks like a bug/limitation to the current approach.