Github user merrimanr commented on the issue:
https://github.com/apache/incubator-metron/pull/453
I think removing the error indexing topology is fine as long as we're
careful to avoid error messages getting stuck in a loop in the case of a failed
index write. I agree that it will remove complexity and make this PR easier to
digest.
As of this JIRA all errors go to a single error index with source type and
error type as JSON fields. To answer your question: the error indexing
config. I can see the advantage of being able to configure each source
type/error type combination separately but I'm not sure it matters that much
since we expect it to be very low volume. I will think about that more this
weekend. From an implementation standpoint it's easy to modify so the design
should be driven by the queries we expect.
Same applies to invalid messages. Easy to do it either way, just need to
decide what makes the most sense from a user's perspective.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
