I'm unable to see the error attachment for whatever reason, but
piggybacking off of Otto this sounds like you may have a path issue. To
elaborate just a bit further, the pattern when loading from the uber jar
will be relative to the uber jar classpath root, e.g.
jar tfv
metron/metron-platform/metron-parsing/metron-parsing-storm/target/metron-parsing-storm-0.7.0-uber.jar|awk
'{ print $8 }'|sort|less
...
patterns/
patterns/asa
patterns/cisco_patterns
patterns/common
patterns/fireeye
patterns/sourcefire
patterns/squid
patterns/websphere
*patterns/yaf*
...
For patterns NOT in the uber jar, you'll want to declare the full HDFS path
in your config.
...
"parserConfig":
{
"grokPath": "*/apps/metron/patterns/*yourGrokPattern"
...
Best,
Mike
On Wed, Feb 13, 2019 at 7:03 AM Otto Fowler <[email protected]> wrote:
> The patterns, if not in HDFS are loaded from the uber jar itself.
> Can you create a jira with the error and a sanitized version of the
> failing line, as well as the sensor configuration you have?
>
>
> On February 11, 2019 at 03:48:36, Farrukh Naveed Anjum (
> [email protected]) wrote:
>
> Could not find grok statement in HDFS or classpath at /patterns/yaf
> I am getting this Error in YAF
>
> --
> With Regards
> Farrukh Naveed Anjum
>
>
