[
https://issues.apache.org/jira/browse/METRON-694?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15876980#comment-15876980
]
ASF GitHub Bot commented on METRON-694:
---------------------------------------
Github user merrimanr commented on the issue:
https://github.com/apache/incubator-metron/pull/453
So the consensus is to use a single indexing topology for both error and
normal messages by default. I will remove the scripts and configuration (flux
and properties) files and remove the error indexing topology from the MPack.
If a user wants to use a separate error indexing topology it will be their
responsibility to change error topic setting and start a separate indexing
topology. Does this sound ok to everyone?
A couple questions are still unanswered. How granular should the error
topic setting be? I will assume global config is acceptable unless I hear
otherwise. Also, as @cestella alluded to earlier, what should the structure of
the source.type field be? I see these as possibilities:
1. source.type is 'error' with sensor name and error type in separate
fields (1 index config)
2. source.type is error type with sensor name in separate field (index
config per error type)
3. source.type is sensor name + '_error' (additional error index config per
sensor)
If no one has any strong opinions I will stick with option 1.
> Index Errors from Topologies
> ----------------------------
>
> Key: METRON-694
> URL: https://issues.apache.org/jira/browse/METRON-694
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
>
> Need to make sure (and review) that all the bolts write into the error queue.
> Errors should then be consumed from the error queue and indexed.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
