Duplicate query compound keys

[baphael]

Hello,
has anyone ever witnessed duplicate values in self.rule['compound_query_key'] during the processing of a match ?

I noticed that after a flood of errors with this message : Error while querying for alert silence status : RequestError(400, 'illegal_argument_exception', "Term is longer than maximum indexable length, term starting with [...')

Turns out this is caused by duplicate values in compound_query_key that I could observe through a MatchEnhancement (by just logging self.rule['compound_query_key'] to console and starting a rule in debug mode. Yet, self.rule['query_key'] has no duplicates).

I currently run into this problem and don't understand its origin. If anyone would have a hint, it would be much appreciated.

Thanks in advance.

[baphael]

Nevermind, it's caused by a lack of vigilence about Python's "Pass by object reference" mechanism. 🤦‍♂️

I've used

some_variable_name = self.rule.get("compound_query_key", [])

instead of

some_variable_name = list(self.rule.get("compound_query_key", []))
or
some_variable_name = self.rule.get("compound_query_key", []).copy()
or
some_variable_name = copy.deepcopy(self.rule.get("compound_query_key", []))

in order to work on a copy of rule's compound_query_key...

https://stackoverflow.com/questions/2465921/how-to-copy-a-dictionary-and-only-edit-the-copy

Have a nice day.