Just a heads up, there is active work on upgraded Solr support - https://github.com/apache/metron/tree/feature/METRON-1416-upgrade-solr
On Mon, Apr 23, 2018 at 7:53 AM, David McGinnis <mcginn...@avalonconsult.com > wrote: > Tom, > > While I'm not a Metron or Security expert by any means, I recently did a > Metron POC and a partial Spot POC for a client, so I can at least give you > what we found from the process. All notes are as of March, 2018, when the > POCs were created. > > *Metron Pros:* > > - Much more stable at this point > - Supports Kerberized clusters > - Installable through an MPack > - More flexible as far as what you can track and what you want to > alert on > > > *Spot Pros:* > > - More Machine Learning algorithms baked in and easier to use > - Once built, it seems to be more of a straightforward solution out of > the box (i.e. it knows what it's looking for, so you don't have to) > > *Differences That May Matter When Deciding:* > > - Spot requires Impala, while Metron requires Elasticsearch and Kibana > - I've seen some documentation discussing using Solr instead of ES, > but I'm not sure how solid this is yet. > > My current guidance personally would be to use Metron if you are in HDP. > If you are on another distribution, Metron still might be the right choice > at the moment, but personally that would change once they get around to > supporting kerberized environments and fleshing out their installation > steps more. > > FWIW, the client ended up going with Metron, since they were on a secured > HDP cluster anyways. > > On Mon, Apr 23, 2018 at 3:26 AM, tom ryan <tomry...@gmail.com> wrote: > >> Hi All, >> >> Could someone shed a little light on the relative strengths and >> weaknesses of Metron vs Spot? I couldn't find an existing answer, but if >> one exists I'd appreciate a pointer. >> >> Happy to provide more background on my use case and priorities if that >> would help. >> >> Thanks, >> Tom >> > > > > -- > David McGinnis > Staff Hadoop Consultant | Avalon Consulting, LLC > <http://www.avalonconsult.com/>M: (513) 439-0082 > LinkedIn <http://www.linkedin.com/company/avalon-consulting-llc> | Google+ > <http://www.google.com/+AvalonConsultingLLC> | Twitter > <https://twitter.com/avalonconsult> > ------------------------------------------------------------ > ------------------------------------------------- > This message (including any attachments) contains confidential information > intended for a specific individual and purpose, and is protected by law. > If > you are not the intended recipient, you should delete this message. Any > disclosure, copying, or distribution of this message, or the taking of any > action based on it, is strictly prohibited. >
