Versions Compared

Old Version 26

changes.mady.by.user George Vetticaden

Saved on

compared with

New Version 27

changes.mady.by.user George Vetticaden

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. ssh into Host $HOST_WITH_ENRICHMENT_TAG as root
  2. Open up the global validation configuration
    1. vi /usr/metron/$METRON_VERSION/config/zookeeper/global.json
    2. Add the following validation configuration to it and save it. the file after the es configuration

        "{
        "es.clustername": "metron",
        "es.ip": "$SEARCH_HOST", //make sure to replace this
        "es.port": "$SEARCH_HOST_PORT", //make sure to replace this
        "es.date.format": "yyyy.MM.dd.HH",
        "fieldValidations" : [
         {
            "input" : [ "ip_src_addr", "ip_dst_addr" ],
            "validation" : "IP",
            "config" : {
            "type" : "IPV4"
             }
         }
        ]
       }

       

  3. Push the global configuration to zookeeper 
    1. /usr/metron/$METRON_VERSION/bin/zk_load_configs.sh -i /usr/metron/$METRON_VERSION/config/zookeeper -m PUSH -z $ZOOKEEPER_HOST:2181
  4. Dump the configs and validate it got persisted
    1. /usr/metron/$METRON_VERSION/bin/zk_load_configs.sh -m DUMP -z $ZOOKEEPER_HOST:2181

...

The below describes the validation configuration you see above.

Image RemovedImage Added

More details on the validation framework can be found in the Validation Framework section here: https://github.com/apache/incubator-metron/tree/master/metron-platform/metron-common#transformation-language

...