question Re: how to use the metron ui to see the pcap data? in Archives of Support Questions (Read Only)

how to use the metron ui to see the pcap data?

leezy — Tue, 31 May 2016 17:20:51 GMT

hi all:

I use the kibana to query the pcap data through pcap_service that it was said in this link,https://cwiki.apache.org/confluence/display/METRON/PCAP+Service. And the pcap have be writed in the hdfs. But in the pcap panel of kibana dashboard, there are not search button that the above link shows.

Re: how to use the metron ui to see the pcap data?

mmiklavcic — Fri, 10 Jun 2016 03:19:01 GMT

Hi @li zhen - Thanks for the interest in Metron! Please bear with us - we recently upgraded Kibana and that search functionality is not currently exposed in the new UI as a result. There is a CLI tool in the works that will expose this as a workaround.

Note: if you're not working from the latest master branch, it may be that you just need to fill in all the fields for the search to work.

Update 6/17/16 - There is a pending pull request for the CLI tool. You can track it here - https://issues.apache.org/jira/browse/METRON-235

Update 6/22/16 - This work is now complete and committed in master. See the Jira above as well as the following docs:

Re: how to use the metron ui to see the pcap data?

leezy — Tue, 14 Jun 2016 14:05:28 GMT

@Michael Miklavcic thank you for reply, but when i use the latest master branch, there is no panels in the dashboard. How can i config the kibana4 to view the data like in old metron-ui?

Re: how to use the metron ui to see the pcap data?

mmiklavcic — Sat, 18 Jun 2016 00:59:36 GMT

@li zhen There is open work for this being done as well 🙂

Re: how to use the metron ui to see the pcap data?

nnat25191 — Sat, 09 Sep 2017 02:41:22 GMT

@David Lyle

@Michael Miklavcic

Hello all, I'm very interested in this topic although it's been over a year. What's the latest development in term of replaying PCAP data using metron UI? I appreciate any feedbacks in advance.