Github user JonZeolla commented on a diff in the pull request:
https://github.com/apache/metron/pull/586#discussion_r123059627
--- Diff:
metron-deployment/packaging/ambari/metron-mpack/src/main/resources/common-services/METRON/CURRENT/package/files/bro_index.template
---
@@ -238,6 +238,538 @@
"qtype_name": {
"type": "string",
"index": "not_analyzed"
+ },
+ "analyzer": {
+ "type": "string",
+ "index": "not_analyzed"
+ },
+ "failure_reason": {
--- End diff --
@nickwallen I think we delay the details of that conversation until/if the
change occurs. I can comment any fields that are used in multiple logs, as
that's probably worthwhile keeping in the template itself.
@ottobackwards Well, I expect people to customize this if they already have
a bro install prior to using Metron, as they will probably have custom and
non-default fields turned on. If not, I would want the template to have full
support of sending data through a default bro install (the intent of this PR).
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
