Created on 07-13-201808:10 AM - edited 09-16-202201:43 AM
Summary
Using Apache Solr as the indexing and search engine for Metron requires the Metron REST service to perform queries to multple collections. If the Ranger plugin is active there is currently a gotcha ( = Ranger Solr plugin bug). If you don't want to give the Metron user full access to all Solr collections here is a workaround.
The Problem
2+ Solr collections that are being queried: metaalert, cef,.... (and other parser collections):
One workaround would be to give metron access to all collections: "*" . We usually don't want that on clusters, that are being used by other use cases.
Another workaround would be to give metron access to "*metaalert*" collection.