Created 12-24-2018 08:49 AM
Hello,
I am using apache metron with elasticsearch, the "metron alert ui/kibana" does not show any data until i restart the `metron indexing` on ambari page. The sensor of snort is sending the data to nifi, from the nifi it send to the kafka. The kafka have the created the topic as expected and the topology are created on storm ui. Unfortunately, the indices on ES is not created, hence no data was displayed on the metron alert ui. After restart the `metron indexing` servive on ambari the data started to shown on kibana and alert ui becouse the indices are now created. so what it need to be done to indices to be created automatically (live data).
Created 12-31-2018 08:31 AM
Hi @Amirul
seems like you got it working, because you are seeing events in elastic. :)
You mention an "Indexing error". Do you have a log snippet that shows the error message?
Created 12-31-2018 08:38 AM