Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
{
"type" : "index_kafka",
"id" : "index_kafka_sep-druid_ab5c9eabc50b5f2_ecipngkn",
"resource" : {
"availabilityGroup" : "index_kafka_sep-druid_ab5c9eabc50b5f2",
"requiredCapacity" : 1
},
"dataSchema" : {
"dataSource" : "sep-druid",
"parser" : {
"type" : "string",
"parseSpec" : {
"timestampSpec" : {
"column" : "fecha",
"format" : "yyyy-MM-dd HH:mm:ss"
},
"dimensionsSpec" : {
"dimensions" : [ "action", "action_field", "actual_action", "admin", "agt_info", "api", "application", "application_hash", "application_name", "application_type", "application_version", "begin_time", "category", "category_type", "cids_signature_id", "cids_signature_string", "cids_signature_subid", "client", "client_user_1", "client_user_2", "command", "company_name", "componente", "computer", "computer_dst", "computer_name", "computer_src", "confidence", "description", "dest_ip", "dest_mac", "dest_port", "detection_score", "detection_type", "device_id", "direction", "disposition", "domain", "domain_name", "domain_sepm", "download_site", "downloaded_by", "duration", "duration_secs", "end_field", "end_time", "event_description", "event_source", "event_time", "facility_label", "file_path", "first_seen", "group_field", "group_name", "hash_type", "hash_value", "host", "ids_message", "insert_time", "intrusion_id", "intrusion_url", "last_update_time", "local_port", "location", "logsource", "parameter", "path", "pid", "prevalence", "process", "product", "product_version", "protocol", "razon_error_carga", "remote_port", "requested_action", "return_address", "return_module", "risk_name", "risk_type", "rule", "rule_name", "scan_id", "scan_type", "secondary_action", "sensitivity", "sepm_name", "sepm_server", "sequence_number", "server_name", "signature", "site_name", "src_ip", "src_mac", "src_port", "src_user", "start_message", "status", "stop_message", "syslog_facility_code", "syslog_severity", "syslog_severity_code", "tags", "type", "url_tracking_status", "user", "user_name", "vendor_direction", "version", "web_domain", "moya_mds", "error_carga", "unknown_ip1", "unknown_ip2", "unknown_mac1", "unknown_mac2", "unknown_port1", "unknown_port2" ],
"dimensionExclusions" : [ "message", "primary_key" ],
"spatialDimensions" : [ ]
},
"format" : "json"
}
},
"metricsSpec" : [ {
"type" : "longSum",
"name" : "file_size",
"fieldName" : "file_size"
}, {
"type" : "longSum",
"name" : "infected",
"fieldName" : "infected"
}, {
"type" : "longSum",
"name" : "infected_count",
"fieldName" : "infected_count"
}, {
"type" : "longSum",
"name" : "occurrences",
"fieldName" : "occurrences"
}, {
"type" : "longSum",
"name" : "omitted",
"fieldName" : "omitted"
}, {
"type" : "longSum",
"name" : "threat_count",
"fieldName" : "threat_count"
}, {
"type" : "longSum",
"name" : "threats",
"fieldName" : "threats"
}, {
"type" : "longSum",
"name" : "total_file_count",
"fieldName" : "total_file_count"
} ],
"granularitySpec" : {
"type" : "uniform",
"segmentGranularity" : "HOUR",
"queryGranularity" : {
"type" : "none"
},
"rollup" : true,
"intervals" : null
}
},
"tuningConfig" : {
"type" : "KafkaTuningConfig",
"maxRowsInMemory" : 5000000,
"maxRowsPerSegment" : 5000000,
"intermediatePersistPeriod" : "PT10M",
"basePersistDirectory" : "/home/centos/druid-0.9.2/var/tmp/1482784039373-0",
"maxPendingPersists" : 0,
"indexSpec" : {
"bitmap" : {
"type" : "concise"
},
"dimensionCompression" : "lz4",
"metricCompression" : "lz4",
"longEncoding" : "longs"
},
"buildV9Directly" : false,
"reportParseExceptions" : false,
"handoffConditionTimeout" : 0
},
"ioConfig" : {
"type" : "kafka",
"baseSequenceName" : "index_kafka_sep-druid_ab5c9eabc50b5f2",
"startPartitions" : {
"topic" : "sep",
"partitionOffsetMap" : {
"0" : 38967101
}
},
"endPartitions" : {
"topic" : "sep",
"partitionOffsetMap" : {
"0" : 9223372036854775807
}
},
"consumerProperties" : {
"bootstrap.servers" : "localhost:9092"
},
"useTransaction" : true,
"pauseAfterRead" : false,
"minimumMessageTime" : null
},
"context" : { },
"groupId" : "index_kafka_sep-druid",
"dataSource" : "sep-druid"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment