This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

field 'Type' is empty

Thomas69 over 1 year ago

Hello!

My problem is the field 'Type' is not populated for the logs that i'm sending into ESM (thub integrated esm if matters, th-cef->avro->avro-enriched->avro-esmfiltered). There are a lot of builtin rules which uses this information. For the time being i have created a pre-persistence rule, which adds the type "Base" to logs that have it without value. Wondering where the value gets added to the events, and where it gets lost.

Thank you in advance.

Regards, Thomas

0 Ionut Daniel Mosoiu over 1 year ago

Hello Thomas,

if you are consuming directly from avro after rooting from cef and topic the filed is populated ?

Best Regards,

Daniel
Cancel
Vote Up 0 Vote Down

Cancel
0 Thomas69 over 1 year ago in reply to Ionut Daniel Mosoiu

Hey!

I've tried consuming right from th-arcsight-avro topic, the result is the same, the field was unpopulated.

However, there is a weird anomaly, for a few events the field gets a value. I have no idea why, all events go through the same process.

Regards, Thomas
Cancel
Vote Up 0 Vote Down

Cancel
0 Ionut Daniel Mosoiu over 1 year ago in reply to Thomas69

Thomas,

Try to see what kind of events are those that the filed gets value. Also notice any differences.

Verify if you can generate events directly into avro without using the routing process to isolate the issue.

Then you can open an case and provide all the detailed information.

Best Regards,

Daniel
Cancel
Vote Up 0 Vote Down

Cancel
0 vitz1 over 1 year ago in reply to Thomas69

did you check if aggregated event count !=1 where "type" is not populated?
Cancel
Vote Up 0 Vote Down

Cancel
Suggested Answer

0 jgassner over 1 year ago

The issue you described looks like it matches issue #365131 that was fixed in the Transformation Hub 3.6 release as indicated in the release notes at www.microfocus.com/.../
Cancel
Vote Up 0 Vote Down

Cancel

Menu

ArcSight User Discussions

field 'Type' is empty

Suggested Answer

Resources