CUCM SP Table Reports are only displaying 100 CDRs

Products

• VMware Smart Assurance

Issue/Introduction

The purpose of this knowledge base article is to provide a workaround to allow for "X" number of results to be retrieved when using ElasticSearch.

Environment

Watch4Net/M&R - 7.x

Cause

1). In M&R 6.6u1, the file ES-CISCO-CDR.xml referenced the property "pkid" with a total count which allowed for unlimited number of CDR's to be retrieved from Datastore. With the introduction of M&R 6.8ux, Datastore has been replaced with ElasticSearch, and the pkid section was removed.

2). A bug was identified in the Cisco CUCM SP in M&R 6.8u5, specifically the ES-CISCO-CDR.xml does not include the section for pkid which allows reporting on CDR's. 

3). The impact is that with the missing "pkid"  in the ES-CISCO-CDR.xml file only a limited number of CDR's  (100 to be exact) can be reported

4). The "pkid" section was included in the ES-CISCO-CDR.xml in M&R 6.6u1 and earlier which leveraged the Datastore instead of ElasticSearch, and so this was handled fine in earlier versions. 

Resolution

To resolve the issue, the following section needs to be added to the ES-CISCO-CDR.xml file:

<property name="pkid">
                <field type="source">pkid</field>
                <exact-match>{ "term" : { "pkid" : "${value?json}" } }</exact-match>
                <pattern-match>{ "wildcard" : { "pkid" : "${value?json}" } }</pattern-match>
                <exists>{ "exists" : { "field" : "pkid"} }</exists>
                <expansion>{ "terms" : { "field" : "pkid", "size" : 10000} }</expansion>
</property>

Workaround:
No other available work around exists.

Additional Information

Impact/Risks:
Only 100 CDR results are retrieved from from the CUCM SP in reports, which leverages ElasticSearch.