[
https://issues.apache.org/jira/browse/METRON-694?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15872461#comment-15872461
]
ASF GitHub Bot commented on METRON-694:
---------------------------------------
Github user cestella commented on the issue:
https://github.com/apache/incubator-metron/pull/453
Ok, catching up on this:
Regarding invalid vs errors, I'm ok with the notion of treating them the
same, but it's different from how we've done this in the past. Prior to this,
invalid messages went into a queue untouched. Now, they will be sent along
with the errors wrapped in a JSON structure (thought the raw messages will be
captured as a field). I'm not necessarily against this, but it's different
than as we originally designed and I want to call it out.
I guess I'm ok with adding a new topology, but it's added a fair amount of
complexity to this JIRA and I'm not sure I buy that indexing errors (what
should be a rare event, IMO, in a healthy set of topologies) would materially
change how we tune the indexing topology, which has to be able to handle the
unified traffic of all of the parsers anyway.
So, if I have an error in a message with a source type of `bro`, what
indexing config am I using as of this JIRA?
* the `bro` indexing config
* the `error` indexing config
* a new `bro_error` indexing config
> Index Errors from Topologies
> ----------------------------
>
> Key: METRON-694
> URL: https://issues.apache.org/jira/browse/METRON-694
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
>
> Need to make sure (and review) that all the bolts write into the error queue.
> Errors should then be consumed from the error queue and indexed.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
