Github user james-sirota commented on the pull request:
https://github.com/apache/incubator-metron/pull/127#issuecomment-222414251
On AWS the following did not work:
/usr/metron/0.1BETA/bin/start_parser_topology.sh -s user -k xxx:9092 -z
xxx:2181
I got a:
41 [main-EventThread] INFO o.a.c.f.s.ConnectionStateManager - State
change: CONNECTED
java.lang.NullPointerException
at
org.apache.metron.parsers.topology.ParserTopologyBuilder.build(ParserTopologyBuilder.java:57)
at
org.apache.metron.parsers.topology.ParserTopologyCLI.main(ParserTopologyCLI.java:232)
Looking at the file here:
https://github.com/cestella/incubator-metron/blob/METRON-174/metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/topology/ParserTopologyBuilder.java
looks like it chokes on the sensor topic. However, listing the topics:
/usr/hdp/current/kafka-broker/bin/kafka-topics.sh --list --zookeeper
xxx:2181
bro
enrichments
pcap
snort
user
yaf
looks like i have it correct. My parser topology config looks as follows:
{
"parserClassName" : "org.apache.metron.parsers.csv.CSVParser"
,"writerClassName" :
"org.apache.metron.writer.hbase.SimpleHbaseEnrichmentWriter"
,"sensorTopic":"user"
,"parserConfig":
{
"shew.table" : "enrichment"
,"shew.cf" : "t"
,"shew.keyColumns" : "user"
,"shew.enrichmentType" : "user"
,"columns" : {
"user" : 0
,"ip" : 1
}
}
}
And is located under /usr/metron/0.1BETA/config/zookeeper/parsers/user.json
Any suggestions?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
