Hey @Otto Fowler, thanks for getting back. Sure, I will send the question to that group, it could just be a newbie thing, but I was not able to find a log that could point to the right direction, but surely I will send the question. Thanks. ... View more

Hey @Otto Fowler Can you please help here ?. I ping you directly because you pushed the sample code 🙂 (https://github.com/apache/metron/blob/master/metron-stellar/stellar-3rd-party-example/src/main/java/org/apache/metron/stellar/external/TimeFunction.java ) Thanks in advance 🙂 ... View more

Hey @Jay Bhavsar, did you manage to address this issue? I believe I'm having the same issue. ... View more

I deleted @Bob Van Haute answer by mistake, adding it back here. Manually setting the source.type field seems to do the job. For your case for example: "fieldTransformations": [ { "input": [], "output": [ "source.type" ], "transformation": "STELLAR", "config": { "source.type": "JOIN(['squid',location,country],'-')" } } ] C ... View more

Hi @Bob Van Haute, That seems to work, however, the elasticsearch and hdfs indices are created wit the default configuration, because the indexing configuration wont match, leading the sensor to use the default configuration (https://docs.hortonworks.com/HDPDocuments/HCP1/HCP-1.6.1/runbook/content/default_configuration.html) { "hdfs": { "batchSize": 10, "enabled": true, "index": "squid" }, "elasticsearch": { "batchSize": 10, "enabled": true, "index": "squid" }, "solr": { "batchSize": 1, "enabled": false, "index": "squid" } } Storm also shows a warning because it uses the default (and potential, unoptimized settings) . Question here Is it possible that above settings matches a wildcard like *squid* ? java.lang.Exception: WARNING: Default and (likely) unoptimized writer config used for hdfs writer and sensor squid.london at org.apache.metron.writer.bolt.BulkMessageWriterBolt.execute(BulkMessageWriterBolt.java:234) at org.apache.storm.daemon.executor$fn__10193$tuple_action_fn__10195.invoke(executor.clj:730) at org.apache.storm.daemon.executor$mk_task_receiver$fn__10114.invoke(executor.clj:462) at org.apache.storm.disruptor$clojure_handler$reify__4137.onEvent(disruptor.clj:40) at org.apache.storm.utils.DisruptorQueue.consumeBatchToCursor(DisruptorQueue.java:472) at org.apache.storm.utils.DisruptorQueue.consumeBatchWhenAvailable(DisruptorQueue.java:451) at org.apache.storm.disruptor$consume_batch_when_available.invoke(disruptor.clj:73) at org.apache.storm.daemon.executor$fn__10193$fn__10206$fn__10259.invoke(executor.clj:849) at org.apache.storm.util$async_loop$fn__1221.invoke(util.clj:484) at clojure.lang.AFn.run(AFn.java:22) at java.lang.Thread.run(Thread.java:745) ... View more

Hi there. Were you able to address the issue described here? ... View more

I'm expecting the same issue. Did you manage to solve it? Any feedback is highly appreciated. ... View more