Jon Zeolla created METRON-1746: ---------------------------------- Summary: CEF lacks an ES template Key: METRON-1746 URL: https://issues.apache.org/jira/browse/METRON-1746 Project: Metron Issue Type: Sub-task Reporter: Jon Zeolla
An ES template should exist here<https://github.com/apache/metron/tree/9fdccba371c1f1e0dcb79e00a7207a934b79b64c/metron-deployment/packaging/ambari/metron-mpack/src/main/resources/common-services/METRON/CURRENT/package/files> If you only pass in CEF data, the alerts UI will not be able to display anything, and ES will return a 500 saying "Fielddata is disabled on text fields by default." -- This message was sent by Atlassian JIRA (v7.6.3#76005)