question Re: Metron Cannot write to ElasticSearch in Support Questions

Metron Cannot write to ElasticSearch

anggriawanrezab — Thu, 26 Apr 2018 16:54:19 GMT

I tried to add new telemetry sensor on metron. on Metron management UI and STORM UI the sensor shows it running and transmitting. but the ElasticSearch won't create index for the sensor.

Please Help. Thanks

Re: Metron Cannot write to ElasticSearch

anggriawanrezab — Thu, 17 May 2018 10:13:04 GMT

Addition, after i try and make the parser error, the error successfully sent to elastic search and hdfs with the error index. But if the parser is right it failed to sent to elasticsearch and HDFS

Re: Metron Cannot write to ElasticSearch

anggriawanrezab — Fri, 25 May 2018 09:07:42 GMT

the problem solved. i follow this link :

https://community.hortonworks.com/questions/167633/metron-grok-parser-indexing-and-enrichment-not-wor.html

and it helps.

Re: Metron Cannot write to ElasticSearch

sanboju2 — Fri, 25 May 2018 18:45:26 GMT

i have the same issue. But i use logstash storm didnt throw any errors but index is not created? Any idea what to do next?

Re: Metron Cannot write to ElasticSearch

anggriawanrezab — Mon, 28 May 2018 11:31:36 GMT

i never used storm with logstash, but in my case i need to specify the field of the log which will be used for timestamp.

example : there is timestamp field in my log, and i named it 'timestamp'. then i need to specify that 'timestamp' field will be used as timestamp which will be sent to elasticsearch. and after that my problem solved.

hope it helps