You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@metron.apache.org by nickwallen <gi...@git.apache.org> on 2016/06/22 19:31:14 UTC
[GitHub] incubator-metron pull request #169: METRON-252 Metron Dashboard Can Be Broke...
GitHub user nickwallen opened a pull request:
https://github.com/apache/incubator-metron/pull/169
METRON-252 Metron Dashboard Can Be Broken By Adding Index
[METRON-252](https://issues.apache.org/jira/browse/METRON-252)
#### Problem
There are some visuals in the default dashboard that cross multiple indices. The only way to do this via Kibana's web interface, is to create a "*" or wildcard index. Unfortunately, this can also pull in other unrelated indices that could potentially impact the functioning of the dashboard.
For example, in this specific scenario an additional index was added that had the same field name, but a different data type than Snort, YAF, and Bro. This thoroughly confused Kibana and caused it to report the following error when viewing Metron's Dashboard.
```
Error: [unsupported_operation_exception] custom format isn't supported
```
#### Solution
If you modify the JSON used to create the .kibana index manually, there is a way to specify multiple indexes for a visualization instead of using a wildcard index pattern. Previously, there were multiple visuals with index references as follows.
```
{\"index\":\"*\"
```
These have all been changed to specifically reference the 3 default sensors.
```
{\"index\":[\"yaf*\", \"bro*\", \"snort*\"]
```
This ensures that no other indices can impact the default dashboard.
This was tested by deploying to an AWS cluster. The dashboard was able to function in the presence of the same index that had previously broken it.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/nickwallen/incubator-metron METRON-252
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/incubator-metron/pull/169.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #169
----
commit 54930f0f6cbeb03ecfb88ab4c44aa3bbffa7df4e
Author: Nick Allen <ni...@nickallen.org>
Date: 2016-06-22T19:16:26Z
METRON-252 Using index sets instead of a wildcard index for visuals that cross multiple indices
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #169: METRON-252 Metron Dashboard Can Be Broke...
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/incubator-metron/pull/169
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #169: METRON-252 Metron Dashboard Can Be Broke...
Posted by nickwallen <gi...@git.apache.org>.
Github user nickwallen closed the pull request at:
https://github.com/apache/incubator-metron/pull/169
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #169: METRON-252 Metron Dashboard Can Be Broken By Ad...
Posted by cestella <gi...@git.apache.org>.
Github user cestella commented on the issue:
https://github.com/apache/incubator-metron/pull/169
+1, spun up in vagrant
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #169: METRON-252 Metron Dashboard Can Be Broken By Ad...
Posted by james-sirota <gi...@git.apache.org>.
Github user james-sirota commented on the issue:
https://github.com/apache/incubator-metron/pull/169
+ 1
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #169: METRON-252 Metron Dashboard Can Be Broke...
Posted by nickwallen <gi...@git.apache.org>.
GitHub user nickwallen reopened a pull request:
https://github.com/apache/incubator-metron/pull/169
METRON-252 Metron Dashboard Can Be Broken By Adding Index
[METRON-252](https://issues.apache.org/jira/browse/METRON-252)
#### Problem
There are some visuals in the default dashboard that cross multiple indices. The only way to do this via Kibana's web interface, is to create a "*" or wildcard index. Unfortunately, this can also pull in other unrelated indices that could potentially impact the functioning of the dashboard.
For example, in this specific scenario an additional index was added that had the same field name, but a different data type than Snort, YAF, and Bro. This thoroughly confused Kibana and caused it to report the following error when viewing Metron's Dashboard.
```
Error: [unsupported_operation_exception] custom format isn't supported
```
#### Solution
If you modify the JSON used to create the .kibana index manually, there is a way to specify multiple indexes for a visualization instead of using a wildcard index pattern. Previously, there were multiple visuals with index references as follows.
```
{\"index\":\"*\"
```
These have all been changed to specifically reference the 3 default sensors.
```
{\"index\":[\"yaf*\", \"bro*\", \"snort*\"]
```
This ensures that no other indices can impact the default dashboard.
This was tested by deploying to an AWS cluster. The dashboard was able to function in the presence of the same index that had previously broken it.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/nickwallen/incubator-metron METRON-252
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/incubator-metron/pull/169.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #169
----
commit 54930f0f6cbeb03ecfb88ab4c44aa3bbffa7df4e
Author: Nick Allen <ni...@nickallen.org>
Date: 2016-06-22T19:16:26Z
METRON-252 Using index sets instead of a wildcard index for visuals that cross multiple indices
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---