how to use the metron ui to see the pcap data?

[#1]

hi all:

I use the kibana to query the pcap data through pcap_service that it was said in this link,https://cwiki.apache.org/confluence/display/METRON/PCAP+Service. And the pcap have be writed in the hdfs. But in the pcap panel of kibana dashboard, there are not search button that the above link shows.

[#2 · Accepted solution]

Hi @li zhen - Thanks for the interest in Metron! Please bear with us - we recently upgraded Kibana and that search functionality is not currently exposed in the new UI as a result. There is a CLI tool in the works that will expose this as a workaround.

Note: if you're not working from the latest master branch, it may be that you just need to fill in all the fields for the search to work.

Update 6/17/16 - There is a pending pull request for the CLI tool. You can track it here - https://issues.apache.org/jira/browse/METRON-235

Update 6/22/16 - This work is now complete and committed in master. See the Jira above as well as the following docs:

• https://cwiki.apache.org/confluence/display/METRON/PCAP+CLI+Tool
• https://github.com/apache/incubator-metron/blob/master/metron-platform/metron-pcap-backend/README.md

[#3]

@Michael Miklavcic thank you for reply, but when i use the latest master branch, there is no panels in the dashboard. How can i config the kibana4 to view the data like in old metron-ui?

[#4]

@li zhen There is open work for this being done as well 🙂

[#5]

@David Lyle

@Michael Miklavcic

Hello all, I'm very interested in this topic although it's been over a year. What's the latest development in term of replaying PCAP data using metron UI? I appreciate any feedbacks in advance.