Github user JonZeolla commented on the issue:
https://github.com/apache/incubator-metron/pull/326
Not the best, but from my install node, inside the docker container I used
to install, I inserted the updated template to my ES cluster via:
`curl --data
"@/root/incubator-metron/metron-deployment/roles/metron_elasticsearch_templates/files/es_templates/bro_index.template"
-XPUT server5:9200/_template/bro_index`
Then I put a message on the indexing topic with a response_body_len of
4261543936 (a value I saw cause this issue in the past):
`echo ${jsonBlob} |
/usr/hdp/2.4.0.0-169/kafka/bin/kafka-console-producer.sh --topic indexing
--broker-list server1:6667,server2:6667,server3:6667,server4:6667`
And watched the indexing topic, monitoring for the value in the
response_body_len field:
`/usr/hdp/2.4.0.0-169/kafka/bin/kafka-console-consumer.sh --zookeeper $zk
--topic indexing | grep 4261543936`
Finally, I successfully searched for a response_body_len of 4261543936 in
kibana, as well as a more general response_body_len:>2147483647, which provided
valid responses.
I also pursued testing this in quick-dev but it knocked over my laptop, so
I'll be setting up a VM to do that in the future...
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
