Github user nickwallen commented on the issue:

    https://github.com/apache/metron/pull/1215
  
    When switching parser topologies, some of the original parser topologies 
can fail to be shut down properly.  
    
    #### Steps to Replicate:
    1. Start with default parsers; [bro,snort]
    1. Change Metron Parsers setting to use aggregation; ["bro","snort,yaf"]
    1. The original "snort" topology is never shutdown.  I would expect this to 
be shutdown.
    Parsers Running: bro, snort__yaf, snort
    Parsers Expected: bro, snort__yaf
    
    ![screen shot 2018-10-01 at 1 06 07 
pm](https://user-images.githubusercontent.com/2475409/46303780-ccf39e80-c57a-11e8-96b7-953d0f3b0fef.png)
    
    It seems that the code needs to take into account the original field 
setting when shutting down the parsers, but then use the new setting when 
starting the parsers.



---

Reply via email to