Re: [DISCUSS] Alternatives to split/join enrichment

2018-02-22 Thread Casey Stella
FYI, the PR for this is up at https://github.com/apache/metron/pull/940 For those interested, please comment on the actual implementation there. On Thu, Feb 22, 2018 at 12:43 PM, Casey Stella wrote: > So, these are good questions, as usual Otto :) > > > how does this effect the distribution of w

Re: [DISCUSS] Alternatives to split/join enrichment

2018-02-22 Thread Casey Stella
So, these are good questions, as usual Otto :) > how does this effect the distribution of work through the cluster, and resiliency of the topologies? This moves us to a data parallelism scheme rather than a task parallelism scheme. This, in effect means, that we will not be distributing the part

Re: [DISCUSS] Alternatives to split/join enrichment

2018-02-22 Thread Otto Fowler
Also, how are we to measure the effect? Not to get all six sigma ;) On February 22, 2018 at 11:48:41, Otto Fowler (ottobackwa...@gmail.com) wrote: This sounds worth exploring. A couple of questions: * how does this effect the distribution of work through the cluster, and resiliency of the top

Re: [DISCUSS] Alternatives to split/join enrichment

2018-02-22 Thread Otto Fowler
This sounds worth exploring. A couple of questions: * how does this effect the distribution of work through the cluster, and resiliency of the topologies? * Is anyone else doing it like this? * Can we have multiple thread pools and group tasks together ( or separate them ) wrt hbase? On Februa

[DISCUSS] Alternatives to split/join enrichment

2018-02-22 Thread Casey Stella
Hi all, I've been thinking and working on something that I wanted to get some feedback on. The way that we do our enrichments, the split/join architecture was created to effectively to parallel enrichments in a storm-like way in contrast to OpenSoc. There are some good parts to this architecture