[
https://issues.apache.org/jira/browse/METRON-578?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15690507#comment-15690507
]
ASF GitHub Bot commented on METRON-578:
---------------------------------------
Github user ottobackwards commented on the issue:
https://github.com/apache/incubator-metron/pull/363
What I'm looking at is the Processor interface implementations and seeing
if that can be reduced by providing some same base and derivation ( like the ES
and Solr processor code is the same just about ). I'm not looking as much at
cleanup as refactoring to make it easier to do standard testing things. If I
understand what you are looking for, there would be two jiras.
> Missing error handling bolts for enrichment and threat intel
> ------------------------------------------------------------
>
> Key: METRON-578
> URL: https://issues.apache.org/jira/browse/METRON-578
> Project: Metron
> Issue Type: Improvement
> Affects Versions: 0.2.1BETA
> Reporter: Justin Leet
> Assignee: Justin Leet
>
> TL;DR - we need to add error handling to enrichments/threat intel
> Metron has parsers, enrichment + threat intel, and indexing topologies
> currently. Parsers and and enrichment have bolts that write to error topics
> in Kafka
> # indexing_error
> # parser_error
> # parser_invalid
> The GenericEnrichmentBolt handles errors gracefully by passing along failed
> enrichment tuples un-enriched and additionally emitting the tuple to an
> "error" stream, however there is currently no plumbing to handle the error
> stream.
> {code:java}
> } catch (Exception e) {
> LOG.error("[Metron] Unable to enrich message: " + rawMessage, e);
> JSONObject error = ErrorUtils.generateErrorMessage("Enrichment problem:
> " + rawMessage, e);
> if (key != null) {
> collector.emit(enrichmentType, new Values(key, enrichedMessage,
> subGroup));
> }
> collector.emit("error", new Values(error));
> }
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
