Hey @Ali - check this out - https://github.com/apache/metron/pull/1286. Obviously, we're not going to have all of the same timestamp properties in the unified topology since there are no more splitters and joiners, but this should fill in the outstanding gaps around the adapter timestamps. I see this as a short-term stopgap solution for metrics. I add these properties back in with the caveat that users should expect them to be deprecated at some point in favor of a more robust metrics solution. Let me know if there's anything you feel we're still missing.
Best, Mike Miklavcic On Tue, Nov 20, 2018 at 11:01 AM Michael Miklavcic < michael.miklav...@gmail.com> wrote: > Thanks for pointing that out Ali. I created a ticket to track it - > https://issues.apache.org/jira/browse/METRON-1889 > > On Mon, Nov 19, 2018 at 11:51 PM Ali Nazemian <alinazem...@gmail.com> > wrote: > >> Hi, >> >> One thing to point out here is there were a few timestamp fields that >> exist for Split-join enrichment topology that haven't been made to the >> unified one. For example, there is no threat intel bolt timestamp. There >> might be some SLA related use cases regarding these timestamp fields that >> might be nice to have before depreciation of the split-join one. Generally >> speaking, makes sense to deprecate split-join topology, though. >> >> Cheers, >> Ali >> >> On Fri, Nov 16, 2018 at 3:40 AM James Sirota <jsir...@apache.org> wrote: >> >> > This is excellent work, Mike and long overdue. Thanks for doing this >> > >> > 05.11.2018, 16:46, "Michael Miklavcic" <michael.miklav...@gmail.com>: >> > > The PR has now been merged into master and closed. >> > > >> > > https://issues.apache.org/jira/browse/METRON-1855 >> > > >> > > On Sat, Nov 3, 2018 at 6:47 PM Michael Miklavcic < >> > > michael.miklav...@gmail.com> wrote: >> > > >> > >> PR is out here - https://github.com/apache/metron/pull/1252 >> > >> >> > >> I made the unified enrichment topology the new default and marked >> the >> > >> split-join topology as deprecated in various parts of the >> > documentation. I >> > >> think we should have a release with the deprecation notes and new >> > default >> > >> and then move to remove split-join entirely shortly thereafter. >> > >> >> > >> Best, >> > >> Mike >> > >> >> > >> On Fri, Nov 2, 2018 at 5:47 AM Mohan Venkateshaiah < >> > >> mvenkatesha...@hortonworks.com> wrote: >> > >> >> > >>> +1 (non-binding) >> > >>> >> > >>> Thanks >> > >>> Mohan DV >> > >>> >> > >>> On 11/2/18, 3:29 PM, "zeo...@gmail.com" <zeo...@gmail.com> wrote: >> > >>> >> > >>> +1 totally agree. >> > >>> >> > >>> Jon >> > >>> >> > >>> On Fri, Nov 2, 2018, 1:31 AM Anand Subramanian < >> > >>> asubraman...@hortonworks.com> >> > >>> wrote: >> > >>> >> > >>> > Piling on my +1 (non-binding) as well. >> > >>> > >> > >>> > On 11/2/18, 4:41 AM, "Ryan Merriman" <merrim...@gmail.com> >> > wrote: >> > >>> > >> > >>> > +1 >> > >>> > >> > >>> > On Thu, Nov 1, 2018 at 5:38 PM Casey Stella < >> ceste...@gmail.com >> > >>> > >> > >>> > wrote: >> > >>> > >> > >>> > > +1 >> > >>> > > On Thu, Nov 1, 2018 at 18:34 Nick Allen < >> n...@nickallen.org> >> > >>> wrote: >> > >>> > > >> > >>> > > > +1 >> > >>> > > > >> > >>> > > > On Thu, Nov 1, 2018, 6:27 PM Justin Leet < >> > >>> justinjl...@gmail.com> >> > >>> > wrote: >> > >>> > > > >> > >>> > > > > +1, I haven't seen any case where the split-join >> topology >> > >>> isn't >> > >>> > made >> > >>> > > > > obsolete by the unified topology. >> > >>> > > > > >> > >>> > > > > On Thu, Nov 1, 2018 at 6:17 PM Michael Miklavcic < >> > >>> > > > > michael.miklav...@gmail.com> wrote: >> > >>> > > > > >> > >>> > > > > > Fellow Metronians, >> > >>> > > > > > >> > >>> > > > > > We've had the unified enrichment topology around for >> a >> > >>> number >> > >>> > of >> > >>> > > months >> > >>> > > > > > now, it has proved itself stable, and there is yet to >> > >>> be a >> > >>> > time that >> > >>> > > I >> > >>> > > > > have >> > >>> > > > > > seen the split-join topology outperform the unified >> > >>> one. Here >> > >>> > are >> > >>> > > some >> > >>> > > > > > simple reasons to deprecate the split-join topology. >> > >>> > > > > > >> > >>> > > > > > 1. Unified topology performs better. >> > >>> > > > > > 2. The configuration, especially for performance >> > >>> tuning is >> > >>> > much, >> > >>> > > > much >> > >>> > > > > > simpler in the unified model. >> > >>> > > > > > 3. The footprint within the cluster is smaller. >> > >>> > > > > > 4. One of the first activities for any install is >> > >>> that we >> > >>> > spend >> > >>> > > time >> > >>> > > > > > instructing users to switch to the unified topology. >> > >>> > > > > > 5. One less moving part to maintain. >> > >>> > > > > > >> > >>> > > > > > I'd like to recommend that we deprecate the >> split-join >> > >>> > topology and >> > >>> > > > make >> > >>> > > > > > the unified enrichment topology the new default. >> > >>> > > > > > >> > >>> > > > > > Best, >> > >>> > > > > > Mike >> > >>> > > > > > >> > >>> > > > > >> > >>> > > > >> > >>> > > >> > >>> > >> > >>> > >> > >>> > -- >> > >>> >> > >>> Jon Zeolla >> > >> > ------------------- >> > Thank you, >> > >> > James Sirota >> > PMC- Apache Metron >> > jsirota AT apache DOT org >> > >> > >> >> -- >> A.Nazemian >> >
