[
https://issues.apache.org/jira/browse/METRON-578?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Casey Stella updated METRON-578:
--------------------------------
Fix Version/s: (was: Next + 1)
0.3.1
> Missing error handling bolts for enrichment and threat intel
> ------------------------------------------------------------
>
> Key: METRON-578
> URL: https://issues.apache.org/jira/browse/METRON-578
> Project: Metron
> Issue Type: Improvement
> Affects Versions: 0.2.1BETA
> Reporter: Justin Leet
> Assignee: Justin Leet
> Fix For: 0.3.1
>
>
> TL;DR - we need to add error handling to enrichments/threat intel
> Metron has parsers, enrichment + threat intel, and indexing topologies
> currently. Parsers and and enrichment have bolts that write to error topics
> in Kafka
> # indexing_error
> # parser_error
> # parser_invalid
> The GenericEnrichmentBolt handles errors gracefully by passing along failed
> enrichment tuples un-enriched and additionally emitting the tuple to an
> "error" stream, however there is currently no plumbing to handle the error
> stream.
> {code:java}
> } catch (Exception e) {
> LOG.error("[Metron] Unable to enrich message: " + rawMessage, e);
> JSONObject error = ErrorUtils.generateErrorMessage("Enrichment problem:
> " + rawMessage, e);
> if (key != null) {
> collector.emit(enrichmentType, new Values(key, enrichedMessage,
> subGroup));
> }
> collector.emit("error", new Values(error));
> }
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
