question Re: Metron 0.4 Alert UI is Empty in Archives of Support Questions (Read Only)

Metron 0.4 Alert UI is Empty

mcas_uvaraj — Sun, 18 Aug 2019 05:22:39 GMT

I have installed Metron 0.4.x in Ubuntu 14.

I have started REST, Metron Management and Alert UI. But Alert is always empty for any search criteria.

Is there any guideline to use alert UI.

Note: Data available in Elasticsearch

Re: Metron 0.4 Alert UI is Empty

asubramanian — Mon, 27 Nov 2017 00:36:24 GMT

@Uvaraj Seerangan, you might be running into METRON-1283. You can confirm that you are hitting this issue as follows - Go to http://node1:9200/snort*/_mappings. If you are missing the "alerts" field from the mapping, then your Alert UI will come up empty

In order to fix the issue, follow these steps:

* Clear all existing Elasticsearch indices

* Go to Ambari UI -> Services -> Metron -> 'Service Actions' dropdown -> Elasticsearch Template Install

* Re-ingest data into Elasticsearch (or let the sensor-stubs running, if this is on full-dev deployment).

And you should now be able to see entries in the Alerts UI.

Re: Metron 0.4 Alert UI is Empty

mcas_uvaraj — Mon, 27 Nov 2017 21:24:28 GMT

Thanks @asubramanian,

I have cleared the existing Elasticsearch indices. We have installed the Metron 0.4.1 manually in Ubuntu 14 as per the steps provided below URL, https://community.hortonworks.com/articles/88843/manually-installing-apache-metron-on-ubuntu-1404.html Uploaded Elasticsearch templates into ES and executed sensor-stubs. Now it is working.