Github user nickwallen commented on the issue: https://github.com/apache/metron/pull/1215 When switching parser topologies, some of the original parser topologies can fail to be shut down properly. #### Steps to Replicate: 1. Start with default parsers; [bro,snort] 1. Change Metron Parsers setting to use aggregation; ["bro","snort,yaf"] 1. The original "snort" topology is never shutdown. I would expect this to be shutdown. Parsers Running: bro, snort__yaf, snort Parsers Expected: bro, snort__yaf ![screen shot 2018-10-01 at 1 06 07 pm](https://user-images.githubusercontent.com/2475409/46303780-ccf39e80-c57a-11e8-96b7-953d0f3b0fef.png) It seems that the code needs to take into account the original field setting when shutting down the parsers, but then use the new setting when starting the parsers.
---