[classifier] Catch KeyError when parsing a record

airbnb · May 14, 2018 · c7d8205 · c7d8205
1 parent 8c3d246
commit c7d8205
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/stream_alert/rule_processor/classifier.py b/stream_alert/rule_processor/classifier.py
@@ -273,9 +273,13 @@ def _parse(self, payload):
             # Convert data types per the schema
             # Use the root schema for the parser due to updates caused by
             # configuration settings such as envelope_keys and optional_keys
-            if not self._convert_type(
-                    parsed_data_value,
-                    schema_match.root_schema):
+            try:
+                if not self._convert_type(
+                        parsed_data_value,
+                        schema_match.root_schema):
+                    return False
+            except KeyError:
+                LOGGER.error('The payload is mis-classified. Payload [%s]', parsed_data_value)
                 return False
 
         normalized_types = StreamThreatIntel.normalized_type_mapping()