Github user anandsubbu commented on the issue:

    https://github.com/apache/metron/pull/1207
  
    @nickwallen suggested a great idea of making use of parser aggregation and 
thus starting the default parsers on full-dev as an aggregated parser topology. 
The latest commit makes use of PR #1215 which provides that ability.
    
    Now, on full-dev we start a single aggregated topology for the default 
configured sensors viz. "bro,snort,yaf".
    
    ## Testing Done
    - Spun up full-dev and noticed that a single topology named 
`bro__snort__yaf` is started
    - Verified Alerts UI has data from all three sensors:
    
    
![image](https://user-images.githubusercontent.com/20395490/46431349-33d6aa80-c769-11e8-8b6e-33940ef9b9eb.png)



---

Reply via email to