Re: [MENTORS] Licensing

ator-metron-bro-plugin-kafka > > > > > On Mon, Apr 10, 2017 at 8:59 PM, zeo...@gmail.com <zeo...@gmail.com> > wrote: > > > Okay great, thanks you. I've sent an email out to general@ to discuss. > > > > It looks like things are all set up on asf > >

Re: [MENTORS] Licensing

al > discussions, and I would recommend PMC members read and/or subscribe to > that list. > > -Taylor > > > On Apr 5, 2017, at 4:50 PM, zeo...@gmail.com <zeo...@gmail.com> wrote: > > > > *Background* > > We have a situation where a portion of code

Re: [MENTORS] Create Additional Repo for Apache Metron Incubating

Thanks! Would you mind taking a look at my other thread, here ? It is related to the use of this new repo. Much appreciated, Jon On Mon, Apr 10, 2017 at 1:54 PM P. Taylor

Failing build

We appear to have a failed build again: No output has been received in the last 10m0s, this potentially indicates a stalled build or something wrong with the build itself. https://travis-ci.org/apache/incubator-metron/builds/219261745 Jon -- Jon

Re: [DISCUSS] The bro kafka plugin

Mentor discussion sent <https://lists.apache.org/thread.html/a4e2e7bb7fb7497033696645b011c5604790f23f3802aaab32f1bd01@%3Cdev.metron.apache.org%3E> Jon On Wed, Apr 5, 2017 at 4:34 PM zeo...@gmail.com <zeo...@gmail.com> wrote: > incubator-metron-bro-plugin-kafka is fine with m

[MENTORS] Licensing

*Background* We have a situation where a portion of code was created for Metron, which is a plugin for a separate open source project, bro. The code was separately pushed out by the initial author to the bro

Re: [DISCUSS] The bro kafka plugin

? > I'd like to see what they've done just so we don't break convention. > > > > > > > On Wed, Apr 5, 2017 at 3:22 PM, Nick Allen <n...@nickallen.org> wrote: > > > Yes, I will open an INFRA ticket. Just give me a little time to > research >

Re: [DISCUSS] The bro kafka plugin

not sure if licensing is a problem here. > > (2) I am OK with whatever we need to get this effort done and under ASF. > > > On Wed, Apr 5, 2017 at 1:12 PM, zeo...@gmail.com <zeo...@gmail.com> wrote: > > > I'm working on this > > <https://github.com/JonZeolla/incu

Re: [DISCUSS] The bro kafka plugin

ro-plugins version and pulling it into the Apache-hosted code. IANAL 2. Nick - are you OK with these changes? Jon On Mon, Apr 3, 2017 at 3:50 PM zeo...@gmail.com <zeo...@gmail.com> wrote: > Can someone on the PMC submit a ticket to INFRA? It looks like > <https://www.apache.org/dev/infra-co

Re: [DISCUSS] next release proposal

How far out is the management UI? Jon On Tue, Apr 4, 2017, 2:09 PM Matt Foley wrote: > Hi all, > Although it’s only been a few weeks since the last release was finally > published, that process started in January :-) > Also, the last commit in 0.3.1 was Feb 23, and there’s

Re: [DISCUSS] The bro kafka plugin

Can someone on the PMC submit a ticket to INFRA? It looks like <https://www.apache.org/dev/infra-contact> committers aren't supposed to. Jon On Fri, Mar 31, 2017 at 4:23 PM zeo...@gmail.com <zeo...@gmail.com> wrote: > I would be happy to try it again but I attempted to

Re: [GitHub] incubator-metron pull request #503: METRON-815 sensor-stubs sometimes send m...

Bro timestamps are often out of order depending on the log because some lines are written when the connection ends and others are written when an event within a connection occurs. As such, timestamps can be confusing to look at initially, but it is very normal for them not to be in order. Also,

Re: How to clean Metro 0.3.1 quick-dev-platform box ?

Sorry about the brevity, answering on my phone. 1. By default the data comes from the sensor-stubs. For more details see https://github.com/apache/incubator-metron/blob/master/metron-deployment/roles/sensor-stubs/README.md 2. The vagrant details come from these two locations -

asf-site

I had considered pushing an updated website today as a part of METRON-810, but when I followed the instructions here I found a surprising amount of changes for asf-site. Is this expected? I sifted through some of the changes

Re: [DISCUSS] The bro kafka plugin

; > On 3/31/17, 10:30 AM, "zeo...@gmail.com" <zeo...@gmail.com> wrote: > > Once we agree on a repo location to host this, I would be happy to put > together the package and update our environments to use bro-pkg to > install > the plugin. I have creat

Re: [DISCUSS] The bro kafka plugin

ng should be fairly easy to see by just doing a diff. It would be great if others want to take on any of that work. I would be glad to offer any support that you need. Thanks, Jon! On Thu, Mar 30, 2017 at 11:20 PM, zeo...@gmail.com <zeo...@gmail.com> wrote: > Ok, great. > >

Re: [DISCUSS] The bro kafka plugin

e a way to host the package > > within Metron? I definitely would like to see the modifications at > > https://github.com/bro/bro-plugins/commit/b9f1f35415cb0db > > 065348da0a5043a8353b4a0a8 brought back into Metron and I'd love for us to > > host the plugin. > > >

[DISCUSS] The bro kafka plugin

Today I was taking a look at METRON-812 , which made me recall some conversations from a while back regarding where the bro kafka plugin should ultimately live, and how to update it. Back in METRON-348

Re: [DISCUSS][PROPOSAL] Maven Plugin to build packages with dependencies

e. > > > > > > > > On March 28, 2017 at 13:00:46, Matt Foley (ma...@apache.org) wrote: > > I support option 1 if Infra will do it. Otherwise 2. But it might be > easier to achieve the Infra request after we have exited the incubator. > --Matt > > On 3/27/1

Re: Unable to build Ansible 2.0.0.2 on macOS using our instructions

Hey Dave, Can you point me to which branch you were referring to? I'd be happy to take a stab at this - I really don't like having broken instructions sitting out there. Thanks, Jon On Wed, Mar 1, 2017 at 4:22 PM zeo...@gmail.com <zeo...@gmail.com> wrote: > Sounds good to me,

Re: [DISCUSS][PROPOSAL] Maven Plugin to build packages with dependencies

I don't have a strong opinion here, but I'm interested to see what the direction on this one will be. Jon On Wed, Mar 22, 2017 at 3:30 PM Otto Fowler wrote: > As we have discussion previously, I am working on a plugin architecture for > parsers and stellar ( down the

Re: Metron Installation on an Ambari-Managed Cluster?

Just to add onto this, that is a feature I have similarly been looking for but my environment hasn't matured enough yet for me to push the topic. I've been installing various versions of master in my hardware environment using Ansible, but ever since the Ambari mpack I have been doing it more

Re: [DISCUSS] Stepping down as release manager

+1 for mattf On Tue, Mar 21, 2017 at 11:04 AM Ryan Merriman wrote: > +1 for Matt > > On Tue, Mar 21, 2017 at 9:44 AM, Matt Foley wrote: > > > Casey, you’ve been a great release manager. I know how much detail > effort > > goes into this role. > > > > I

Re: Cannot close JIRAs I didn't originally request

Thanks Anand! Things seem to be working as expected. Jon On Fri, Mar 17, 2017 at 1:50 AM Anand Subramanian < asubraman...@hortonworks.com> wrote: Hey Jon, Here you go - https://issues.apache.org/jira/browse/METRON-772 -Anand On 3/15/17, 10:29 PM, "zeo...@gmail.com" &

Re: new committer: Jon Zeolla

Thank you everyone, I'm very excited to be a part of the team. Jon On Wed, Mar 15, 2017, 7:25 AM Kyle Richardson wrote: > Welcome Jon and Matt! Well deserved. Glad to have the opportunity to > continue working with you both. > > -Kyle > > > On Mar 14, 2017, at 11:57

Re: [VOTE] Final Board Resolution Draft

Just for clarity, I assume that with removing the committers we'll also remove the committer affiliation? Since I don't have a CCLA in, I'm not a big fan of having CMU's name on the list. Jon On Wed, Mar 15, 2017 at 4:07 PM P. Taylor Goetz wrote: > A few things that should

Re: Cannot close JIRAs I didn't originally request

Jon. I will open the INFRA ticket and > >> respond back to the list. > >> > >> On Tue, Mar 14, 2017 at 2:00 PM, zeo...@gmail.com <zeo...@gmail.com> > >> wrote: > >> > >>> Has this been taken care of, or is there some apprehension

Re: new committer: Matt Foley

Congrats Matt! Jon On Wed, Mar 15, 2017, 12:04 AM Otto Fowler wrote: > Congratulations Matt!!! > > > On March 14, 2017 at 23:41:20, James Sirota (jsir...@apache.org) wrote: > > The Podling Project Management Committee (PPMC) for Apache Metron > (Incubating) > has asked

Re: Cannot close JIRAs I didn't originally request

t requesting “Contributors” be given > the “Transition Issues” permission in the METRON project in Jira. > > --Matt > > On 2/17/17, 9:37 AM, "zeo...@gmail.com" <zeo...@gmail.com> wrote: > > Thoughts? Just want to put this one to rest, one way or another. >

Re: [VOTE] Metron to graduate to TLP

0 (non-binding) On Mon, Mar 13, 2017 at 7:15 PM Ryan Merriman wrote: > +1 (binding) > > > On Mar 13, 2017, at 6:05 PM, Casey Stella wrote: > > > > +1 (binding) > > > >> On Mon, Mar 13, 2017 at 6:37 PM, James Sirota > wrote: > >> >

Re: [VOTE] Cesey Stella for Metron VP

+1 (non-binding) On Mon, Mar 13, 2017 at 6:34 PM James Sirota wrote: > +1 (binding) > > 13.03.2017, 15:34, "James Sirota" : > > This vote is to make Casey Stella our VP after graduation > > > > --- > > Thank you, > > > > James Sirota > >

Re: [DISCUSS] System time vs. Event Time

..@gmail.com> > wrote: > > > @Jon, it looks like it is based on system date. > > > > From ElasticsearchWriter.write: > > String indexPostfix = dateFormat.format(new Date()); > > ... > > indexName = indexName + "_index_" + i

Re: [DISCUSS] Wiki use and migration of docs

quot;cookbook" examples here as well. I think there is overlap > with demos and use cases, but cookbook examples can often be more specific > to a fine grained task. > > Mike > > > On Mon, Mar 6, 2017 at 7:02 AM, zeo...@gmail.com <zeo...@gmail.com> wrote:

Re: [DISCUSS] Wiki use and migration of docs

bump On Sat, Feb 11, 2017 at 2:15 PM zeo...@gmail.com <zeo...@gmail.com> wrote: > This morning I had an opportunity to watch the video from yesterday's > community demo, and there was some really good discussion towards the end > about documentation of examples that I want

Re: Unable to build Ansible 2.0.0.2 on macOS using our instructions

about if I get that done and then publish a reconciled branch with the changes I had to make to get 671 working? -D... On Wed, Mar 1, 2017 at 1:32 PM, zeo...@gmail.com <zeo...@gmail.com> wrote: > Hey Dave, > > Any luck with METRON-196 <https://issues.apache.org/jira/browse

Re: Unable to build Ansible 2.0.0.2 on macOS using our instructions

n it up on your rig. > > On Mon, Feb 13, 2017 at 09:34 zeo...@gmail.com <zeo...@gmail.com> wrote: > > > Ok sounds good. I'm traveling next week, but if the stars align I'll > > review when I get back. > > > > Jon > > > > On Mon, Feb 13, 2017 at 9

Re: [DISCUSS] Bro Zeppelin dashboards

Are you assuming only Conn, DNS, and HTTP logs from Bro? Right now I think that's all that is supported by default. I put something together a few months ago to handle all of the default-on Bro

Re: [DISCUSS] System time vs. Event Time

I'm actually a bit surprised to see METRON-691, because I know a while back I did some experiments to ensure that data was being written to the indexes that relate to the timestamp in the message, not the current time, and I thought that messages were getting written to the proper historical

Re: new committer: Josh Meyer

Congrats Josh! On Thu, Feb 23, 2017, 2:38 PM Otto Fowler wrote: > Nice! Congratulations! > > > On February 23, 2017 at 15:14:42, James Sirota (jsir...@apache.org) wrote: > > The Podling Project Management Committee (PPMC) for Apache Metron > (Incubating) > has asked

Re: [DISCUSS] Management of Elastic and other index schemas

gt;> all the parsers. I think what has to happen is the following: > > >>> > > >>> We have to introduce a partial schema for Metron messages where you > > can > > >>> enforce a schema on a part of a message you want, but at the same &

Re: [DISCUSS][PROPOSAL] Side Loading and Installation of telemetry sources [METRON-258]

Awesome write up and ideas Otto, I also strongly support this idea. As someone who has the development of a few parsers quickly approaching the top of their to do list, I will happily beta test this for you when it's far enough along for that. Until then I will attempt to take a look at your

Re: [DISCUSS] Metron Management UI

ork, or would you expect to be > creating the parser config before the data was flowing into kafka? In the > later case, we could probably rely on copy-pasted samples to design the > parser, and then auto-create topics if not already existing on parser save. > > Simon > > > &

Re: [DISCUSS] Metron Management UI

Well, I think that a UI that does what you show is a huge step forward and I definitely wouldn't want to stop it from getting into the code because of any of the additional features that we are talking about here. That said, I really would like to see the Kafka topic creation as a part of the UI

Re: [DISCUSS] Management of Elastic and other index schemas

I think this is a good direction to move things toward - moving indexing templates to be packaged with parsers (using multiple tiered options) that are then merged with the possible enrich fields before getting added to the indexing technology in use. Now, to read the proposal thread... Jon On

Re: Cannot close JIRAs I didn't originally request

Thoughts? Just want to put this one to rest, one way or another. Jon On Fri, Feb 3, 2017 at 8:03 PM zeo...@gmail.com <zeo...@gmail.com> wrote: > Has anybody had a chance to look into this and decide whether a change > should be made? This specific incident is no longer an issue

Re: Unable to build Ansible 2.0.0.2 on macOS using our instructions

ttable state prior to next week. > > I didn't find anything but the issues I've already mentioned. > > -D... > > On Mon, Feb 13, 2017 at 08:58 zeo...@gmail.com <zeo...@gmail.com> wrote: > > > Are you handling this one under METRON-196? I'd be happy to lend a h

[DISCUSS] Wiki use and migration of docs

This morning I had an opportunity to watch the video from yesterday's community demo, and there was some really good discussion towards the end about documentation of examples that I wanted to follow up with. For future reference, here is the recording

Re: [ANNOUNCE] Metron Apache Community Demo for Metron_0.3.1

Was this recorded like the previous ones ? Unfortunately I had a conflict and wasn't able to make it. Jon On Wed, Feb 8, 2017 at 10:14 AM Casey Stella wrote: > I'd like to show the modifications/enhancements to the

Re: Unable to build Ansible 2.0.0.2 on macOS using our instructions

> > > > > -D... > > > > > > > > > On Fri, Feb 10, 2017 at 9:26 AM, Casey Stella <ceste...@gmail.com> > > wrote: > > > > > > > Hmm, that's disconcerting. I certainly don't mind documenting the > > > > workaround tha

Re: [VOTE] Releasing Apache Metron (incubating) 0.3.1-RC3

-1 (non-binding) due to mpack revision number On Thu, Feb 9, 2017, 2:42 PM Casey Stella wrote: > -1, we didn't rev the mpack. Discussion going on currently as to what > version it should be and Justin volunteered to do the work. I vote we wait > for that and cut another

Re: Rev additional metron components?

C with that change. > > > > I'd also support the following: > > > > Declare it "not ready" and leave it at 1.0.0.0-SNAPSHOT > > Decide 0.3.0 actually did contain MPack 1.0.0.0 and increment this to > > 1.0.1.0. > > (I'm sure there are other ways as w

Rev additional metron components?

So I was spinning up the 0.3.1-RC3 candidate on my bare metal cluster today and I noticed that when I generated the mpack it still had a version of 1.0.0.0. I double checked and made sure that the mpack existed in the 0.3.0 release

Re: Debuging storm 1.0 article

Thanks, I haven't read it yet, but I added it to my reading list. Do you think it would be a good addition to just below this , this

Re: [DISCUSS] Metron Management UI

onit with Ambari Mpack where new topologies will be monitored? Last thing, should metron-parsers*.jar be split into separate parsers jar in case if among 50 parsers we need to update just one and we want to do that from Metron UI? - Dima On 02/01/2017 11:16 PM, zeo...@gmail.com wrote: &g

Re: Cannot close JIRAs I didn't originally request

; instead of Resolved as the completed state for issues. The workflow may > also be why there is no way to specify the reason for the resolution of the > ticket. If we want to make any adjustments to the permissions or workflow, > that will require an INFRA ticket. > > On Thu, Jan 26, 2017 at 8:30 AM

Re: [GitHub] incubator-metron issue #429: METRON-660 [Umbrella] up-to-date versioned docu...

Agreed, sounds good to me. I'm good with it getting merged. Jon On Fri, Feb 3, 2017, 6:31 PM mattf-horton wrote: > Github user mattf-horton commented on the issue: > > https://github.com/apache/incubator-metron/pull/429 > > Hi @JonZeolla , you have good eyes! I

Re: [DISCUSS] Error Indexing

in why do you plan to use this hash > and how? > > - Dima > > On 02/01/2017 06:23 AM, zeo...@gmail.com wrote: > > After thinking on this for a few days I recant my previous suggestion of > > TupleHash256. It's still a bit early for SHA-3 - no good reference > > im

Re: [Discuss] Improve Alerting

Otto, I think you're thinking of the "Enrich enrichment" dev mailing list thread that Dima started. In that case we chatted about passing through enrichment multiple times while decrementing a TTL field to prevent infinite loops (and drop a message to the error queue if TTL == 0) would work just

Re: [DISCUSS] Metron Management UI

Ok great, thanks for the feedback Ryan. I'm going to try and get around to playing with this next week if I can. Currently my productivity machine is "in the shop" getting the battery replaced, so I'm playing man down right now. So if we ignore the current API restrictions, here are my MUST

Re: [DISCUSS] Error Indexing

sticking with FIPS 140-2 is a solid choice. Jon On Thu, Jan 26, 2017, 11:23 AM zeo...@gmail.com <zeo...@gmail.com> wrote: So one more thing regarding why I think we should throw an exception on a failed enrichment. If we do make something like username a constant field, in cases where that i

Re: [DISCUSS] Metron Management UI

First off - this is an awesome first take at a management UI and I'm looking forward to messing around with it. Other than skimming some of the dialogue as it comes in I have not been keeping up with the API PR. Should I be able to assume that the UI PR is broken until the API is merged and the

Re: [DISCUSS] Contributions with multiple authors and requisite modifications to the development guide

ng > >> > # s, squash = use commit, but meld into previous commit > >> > # f, fixup = like "squash", but discard this commit's log message > >> > # x, exec = run command (the rest of the line) using shell > >> > # > >> > #

Re: [MENTORS] ICLA for non-committer contributions

What Ryan has suggested has happened twice before from memory. We should probably make that clear in the development guide if it isn't already. Jon On Fri, Jan 27, 2017, 5:08 PM Casey Stella wrote: > I should add, each of them should have the same PR title, just different

Re: [DISCUSS] Gratuating to Apache Top Level Project

I agree On Fri, Jan 27, 2017 at 3:37 PM Otto Fowler wrote: > +1 > > > On January 23, 2017 at 19:09:13, James Sirota (jsir...@apache.org) wrote: > > I think the Apache Incubation was very valuable learning experience for us, > but it seems like we are ready to become a

Re: [DISCUSS] Next Release (0.3.1) Content

la <ceste...@gmail.com> wrote: > > > So, I agree with the Upgrading.md and I was going to submit a PR at least > > to describe the the changes to indexing configurations that I made during > > the 3.0.1 release. > > > > > > On Thu, Jan 26, 2017 at 10:5

Re: [DISCUSS] Next Release (0.3.1) Content

I haven't had a chance to look through the unresolved JIRAs but I did want to mention a few quick things. First, when we released 0.3.0 and dropped the BETA flag, one of the things that was discussed was putting together a method of documenting upgrades from one version to the next. As one of

Cannot close JIRAs I didn't originally request

I assigned a JIRA (METRON-354 ) to me that was reported by someone else, and it appears that I don't have the permissions to close it. For clarity, I didn't have access to close it before I assigned it to myself either. Would someone be willing

Re: Reporting Issues Wiki

be user@ or dev@ > instead of issues@. David, we have the ability to administer a few > permissions for the Metron JIRA, so people should email us first before > trying INFRA. > > On Thu, Jan 26, 2017 at 7:43 AM, zeo...@gmail.com <zeo...@gmail.com> > wrote: > > > Okay. Si

Re: [DISCUSS] Error Indexing

> message is passed along with no error thrown (only logged). Everywhere > else I'm having trouble identifying specific fields that should be hashed. > Would hashing the message in every case be acceptable? Do you know of a > place where we could hash a field instead? On the topic of e

Reporting Issues Wiki

oin the mailing list, as shown below: Hi! This is the ezmlm program. I'm managing the iss...@metron.incubator.apache.org mailing list. Acknowledgment: I have added the address zeo...@gmail.com to the issues mailing list. Welcome to iss...@metron.incubator.apache.org! Am I missing so

Mailing Lists on Website

Is there a reason why we don't have any Metron-specific mailing lists advertised on the Metron apache page under Mailing Lists ? I would have expected to see them there, but since I don't I'm wondering if there was an explicit decision to not include

Re: [DISCUSS] Error Indexing

; > >topic. > > >4. Write a completely new topology with multiple spouts (1 for each > > >error type listed above) that all feed into a single > > BulkMessageWriterBolt. > > > 1. Good because the current topologies would not need to change > > >

Re: [DISCUSS] Error Indexing

our IP field is invalid and failed validation" > hashing this error string will always result in the same hash. Why not > just use the actual error string? Can you provide an example where you > would use it? > > Thanks, > James > > 23.01.2017, 16:29, "z

Re: Build failing

19, 2017 at 2:49 PM zeo...@gmail.com <zeo...@gmail.com> wrote: > The build has been showing as failing > <https://github.com/apache/incubator-metron> for a little while now. I > know we recently updated the language around Merge Requirements > <https://cwiki.apache.o

Re: [DISCUSS] Error Indexing

As someone who currently fills the platform engineer role, I can give this idea a huge +1. My thoughts: 1. I think it depends on exactly what data is pushed into the index (#3). However, assuming the errors you proposed recording, I can't see huge benefits to having more than one dashboard. I

Re: [VOTE] Release Process Documentation

-1 (non-binding). There appears to be a minor oversight where it goes from Step 9 to Step 14. Jon On Fri, Jan 20, 2017 at 11:56 AM James Sirota wrote: > The document is available here: > https://cwiki.apache.org/confluence/display/METRON/Release+Process > > and is also

Build failing

The build has been showing as failing for a little while now. I know we recently updated the language around Merge Requirements , but if I recall properly our current issue is

Re: [PROPOSAL] up-to-date versioned documentation

t; > Are there any maven experts out there who would be willing to give me > some > > pointers (offline) on how to make use of this apparently simple maven > > plug-in? > > > > I can do the bit of scripting needed to gather the docs. I’ve ope

Re: [VOTE] Reporting Issues Wiki

eels a little cumbersome still. > >>> > > >>> > -Kyle > >>> > > >>> > > On Jan 6, 2017, at 7:53 AM, JJ Meyer <jjmey...@gmail.com> wrote: > >>> > > > >>> > > +1 (non-binding) >

Re: Pittsburgh PA Meetup

he evening starting around 7pm. Jon On Fri, Nov 4, 2016 at 1:16 PM James Sirota <jsir...@apache.org> wrote: > Excellent. Thanks for setting that up, John. There are additional metron > Meetups that will be announced soon. > > 04.11.2016, 03:50, "zeo...@gmail.com" &

Re: [DISCUSS] Moving GeoIP management away from MySQL

Re: extensibility - I am one of those enterprise users who plan to do enrichment using their IPAM data in the next couple of months. However, since the information that I have is a much different format compared to maxmind, my approach was going to make a completely separate HBase enricher. That

Re: [DISCUSS] Moving GeoIP management away from MySQL

Just to make sure it's obvious, there is already a JIRA for this (METRON-283 ), however it lacks the detail being discussed here, so this is good. I'm also personally interested in this migration away from MySQL and would support using MapDB (or

Re: [DISCUSS] Turning off indexing writers feature discussion

': { 'enabled': 'false' } } Jon On Sat, Jan 14, 2017 at 9:24 AM zeo...@gmail.com <zeo...@gmail.com> wrote: > I similarly have a concern there because I prefer being as explicit as > possible, which makes things easier to pick up for new users. Using my > example from earlier this

Re: [DISCUSS] Turning off indexing writers feature discussion

be it's worth the > compromise > > to make it less complex for the advanced case. > > > > Thanks a lot for the suggestion, Nick, it's interesting; I'm beginning > to > > lean your way. > > > > On Fri, Jan 13, 2017 at 2:51 PM, zeo...@gmail.com <zeo...@gmail

Re: [DISCUSS] Turning off indexing writers feature discussion

I like the suggestions you made, Nick. The only thing I would add is that it's also nice to see an explicit when(false), as people newer to the platform may not know where to expect configs for the different writers. Being able to do it either way, which I think is already assumed in your model,

Re: [DISCUSS] Turning off indexing writers feature discussion

Hmm, I'm not sure I agree that in most cases users would accept the default batch size, especially in sizeable environments. In search tiers like ES it is very important, and should be tuned to the specific data that you're sending because it depends on the number of bytes, not necessarily number

Re: [DISCUSS] Turning off indexing writers feature discussion

I think Simon has a very valid suggestion. Additionally, I have a two questions. For the following config: { "index" : "foo" ,"batchSize" : 100 } Are now all logs going to the same index? I read this as a writer-specific override of the sensor-specific defaults to use an index name of foo*

Re: [DISCUSS] Ambari Metron Configuration Management consequences and call to action

Right, good conversation to bring up for sure. Just to comment on production generally only being updated during maintenance windows - I can tell you that my plans are to make my dev, test, and prod Metron a very dynamic and frequently changing environment which will have coordinated but frequent

Re: [DISCUSS] Turning off indexing writers feature discussion

Darn it Nick, you beat me to the punch. =) YES, please. I think I discussed this a while back in my ES tuning conversations, but that's _super_ important. I have this documented here under Elasticsearch > On

Re: [GitHub] incubator-metron issue #400: METRON-636: Capture memory and cpu details as a...

+1 (non-binding) On Thu, Jan 12, 2017, 6:12 AM anandsubbu wrote: > Github user anandsubbu commented on the issue: > > https://github.com/apache/incubator-metron/pull/400 > > Thanks @mattf-horton . > > @nickwallen @JonZeolla is there any other thing you guys feel

Re: Long-term storage for enriched data

fields like URL, user name, and > disposition. This wouldn't be specific to Avro but would allow us to better > search across multiple sensor types in the UI too. Say, for example, if I > have two different proxy solutions. > > -Kyle > > On Fri, Jan 6, 2017 at 2:28 PM, zeo...@gmail.co

Re: Long-term storage for enriched data

an action was allowed or denied). > > Thoughts? > > -Kyle > > On Tue, Jan 3, 2017 at 11:30 AM, zeo...@gmail.com <zeo...@gmail.com> > wrote: > > > For those interested, I ended up finding a recording of the talk itself > > when doing some Avro research - https

Re: [VOTE] Reporting Issues Wiki

+1 (non-binding) On Thu, Jan 5, 2017, 8:30 PM Matt Foley wrote: > +1 (non-binding) > > One typo is still in there: > >>After discussion of the issue on the JIRA if it is clear that you > found a bug then you should file a JIRA > should be > >>After discussion of the

Re: Custom Storm Topologies

oftware Engineer >Phone: 248-909-2769 <(248)%20909-2769> >Email: moore.ty...@goflyball.com > > >On Sat, Dec 31, 2016 at 9:46 AM, zeo...@gmail.com <zeo...@gmail.com> wrote: > >> Casey did a tutorial on how to add your own Stellar function here >> <https://w

Re: Long-term storage for enriched data

quote from another part of the prezo.) But > do look at the prezo please, it gives detailed benchmarks showing when each > one is better. > > --Matt > > On 1/1/17, 5:18 AM, "zeo...@gmail.com" <zeo...@gmail.com> wrote: > > I don't recall a conversation

Re: Long-term storage for enriched data

applications “just need a few > columns” of the tables], ORC with Zlib is a good fit.” (The addition in > square brackets incorporates a quote from another part of the prezo.) But > do look at the prezo please, it gives detailed benchmarks showing when each > one is better. > &

Re: Long-term storage for enriched data

I don't recall a conversation on that product specifically, but I've definitely brought up the need to search HDFS from time to time. Things like Spark SQL, Hive, Oozie have been discussed, but Avro is new to me I'll have to look into it. Are you able to summarize it's benefits? Jon On Wed,

Re: Custom Storm Topologies

ialist tyler.math...@yahoo.com 248-909-2769 <(248)%20909-2769> > On Dec 30, 2016, at 17:54, Otto Fowler <ottobackwa...@gmail.com> wrote: > > They are all extension points. > >> On December 30, 2016 at 16:34:58, zeo...@gmail.com (zeo...@gmail.com) wrote: >> >>

Re: Custom Storm Topologies

mean. You can also integrate with MaaS and create a > service that you can call via STELLAR. > > > > On December 30, 2016 at 15:08:48, Otto Fowler (ottobackwa...@gmail.com) > wrote: > > Or a Maas service? > > > On December 30, 2016 at 13:52:06, zeo...@gma

Re: Custom Storm Topologies

ccessible using stellar functions? > > Regards, > > Tyler Moore > Software Engineer > Phone: 248-909-2769 <(248)%20909-2769> > Email: moore.ty...@goflyball.com > > > On Fri, Dec 30, 2016 at 3:08 PM, Otto Fowler <ottobackwa...@gmail.com> > wrote: > >

  1   2   >