You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@metron.apache.org by "Justin Leet (JIRA)" <ji...@apache.org> on 2018/09/05 15:36:00 UTC

[jira] [Assigned] (METRON-1608) Add configuration for threat.triage.field name

     [ https://issues.apache.org/jira/browse/METRON-1608?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Justin Leet reassigned METRON-1608:
-----------------------------------

    Assignee: Ryan Merriman

> Add configuration for threat.triage.field name
> ----------------------------------------------
>
>                 Key: METRON-1608
>                 URL: https://issues.apache.org/jira/browse/METRON-1608
>             Project: Metron
>          Issue Type: Bug
>            Reporter: Ryan Merriman
>            Assignee: Ryan Merriman
>            Priority: Major
>             Fix For: 0.6.0
>
>
> Currently there is an option for replacing '.'s with ':'s in Elasticsearch field names.  This is the default behavior.  However our current version of Elasticsearch (5.6.2) now allows '.'s so it's possible for users to use '.'s instead.  In the DAO implementation (metaalerts specifically), the threat.triage.field is hardcoded with ':'s and will not work properly if a user switches to using '.'s.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)