[jira] [Commented] (METRON-348) bro-plugin-kafka is missing an important update

["David M. Lyle (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/METRON-348?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15391068#comment-15391068 ] 

David M. Lyle commented on METRON-348:
--------------------------------------

Do we need to be carrying this code at all? What would you think about updating the Ansible Bro task to reference the code from Bro and removing the duplicated code from our tree? I think that's doable now even without Bro refactoring their project.

Also- if I'm reading this correctly, you want the update to send each log stream to a different Kafka topic. IIRC, we send the HTTP and DNS log to a single topic and run a single parser, so we'd need to have some additional parsers to take advantage of that change, wouldn't we?

> bro-plugin-kafka is missing an important update
> -----------------------------------------------
>
>                 Key: METRON-348
>                 URL: https://issues.apache.org/jira/browse/METRON-348
>             Project: Metron
>          Issue Type: Bug
>            Reporter: Jon Zeolla
>             Fix For: 0.2.1BETA
>
>   Original Estimate: 2h
>  Remaining Estimate: 2h
>
> Metron's bro-plugin-kafka (https://github.com/apache/incubator-metron/tree/master/metron-sensors/bro-plugin-kafka) is missing an important update (https://github.com/bro/bro-plugins/commit/b9f1f35415cb0db065348da0a5043a8353b4a0a8).  I have opened a ticket with the bro devs in order to seek a long term resolution to this issue (https://github.com/bro/bro-plugins/issues/31).  
> My suggestion was to have the bro team update the bro/bro-plugins repo to turn folders (plugins) into individual branches so that they could be referenced and updated easily in Metron and other projects as a submodule.  I was going to wait to hear back before filing a PR, but I'm not against a short term fix of simply updating kafka/src/KafkaWriter.cc and kafka/src/KafkaWriter.h.  



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)