Question about "parser_invalid"

Hello everybody, Don't worry, I won't ask you to debug my Grok statement :) By the way, I'm facing the following situation: I have in my "error_index" Elastic index some documents with a raw_message field that shows that the origin message was parsed (see screenshot) and contains in addition an

Re: Snort logs flow issue

Thanks a lot Michael for your help. Will explore further. On Wed, Apr 10, 2019, 3:37 AM Michael Miklavcic wrote: > That table should have been created by default as part of the Ambari > installation of Metron via our MPack - > https://github.com/apache/metron/tree/master/metron-deployment#how-do

Re: Snort logs flow issue

That table should have been created by default as part of the Ambari installation of Metron via our MPack - https://github.com/apache/metron/tree/master/metron-deployment#how-do-i-deploy-metron-with-ambari. You shouldn't have to worry about this at all as an end user, but here is where it happens i

Re: Load_tool.sh issues

Hi Michael, You are correct, we have a script that calls load_tool.sh with: /usr/metron/0.7.0/bin/load_tool.sh -p 1 -mt $index -z dn-01.mgpsoc.pe -md 3000 -tl 3 -l 0 -c /tmp/measure-$index.csv Every 15 minutes, this ran fine for a few months, now, when we try to run the load_tool.sh tool, it'

Re: Metron concept

One thing worth noting is that group.id is essentially a client identifier, so if you specify one that matches another consumer (such as Metron topologies) then they will interfere, and you are likely to balance across your console and the actual Metron processes, so generally when watching a Ka

RE: Metron concept

Hello, I haven’t sorted out yet this issue, but I think I’ve narrowed it. Actually, after many tests with Kafka console-consumer and basic Python scripts, I realize that I can only consume messages when I specify the partition number and not the group.id. This is of course not what storm tries

Re: Snort logs flow issue

Hi Michael, Issue got resolved after I manually created user settings table in hbase. There are no contents in that table though it is working. Where are the records getting stored then for alerts UI. Where can I find the records in HDFS. Thanks and regards, Hema On Tue, Apr 9, 2019, 1:12 PM Hem

Re: Snort logs flow issue

Hi Stephanie, Issue got resolved by creating that table in hbase. Thanks and regards, Hema On Tue, Apr 9, 2019, 1:31 PM wrote: > Hello Hema, > > > > Unless I’m wrong, this must be setup in MySQL, the database you use for > Metron REST. > > > > > > *From:* Hema malini [mailto:nhemamalin...@gmai

RE: Snort logs flow issue

Hello Hema, Unless I’m wrong, this must be setup in MySQL, the database you use for Metron REST. From: Hema malini [mailto:nhemamalin...@gmail.com] Sent: Tuesday, April 09, 2019 09:42 To: user@metron.apache.org Subject: Re: Snort logs flow issue Hi Michael, Sorry just noticed the error in met

Re: Snort logs flow issue

Hi Michael, Sorry just noticed the error in metron rest logs - Table 'user settings' was not found. Do we have to create that hbase table . Where to find the hbase tables created. I could see only two namespace in hbase - default and hbase. No tables created in that. Do I have to run metron rest i

Re: Snort logs flow issue

Hi Michael, Thanks for your reply. I couldn't find any errors in metron alerts UI log . I clicked the search and changed the date range too. Still no records. Do we have to run metron rest in dev profile? On Mon, Apr 8, 2019, 7:50 PM Michael Miklavcic wrote: > If you see them in the dashboard y