Install Solr

If you are using Apache Solr, install it using the Ambari HDP Search management pack.

1. From Ambari, stop the following:
   • Metron
   • Kibana
   • Elasticsearch
2. Install the Ambari HDP Search Management pack.
   For instructions on downloading and using the Ambari HDP Search management pack, see https://docs.cloudera.com/HDPDocuments/HDPS/HDPS-4.0.0/bk_solr-search-installation/content/hdp-search40-install-mpack.html .
   Ambari automatically creates collections for the following:
   • bro
   • snort
   • yaf
   • metaalert
   • error
3. If you want to create a collection for a schema not supplied by CCP, perform the following steps:
   1. Set Solr environmental variables in ZooKeeper.

      # Path to the zookeeper node used by Solr
      export ZOOKEEPER=node1:2181/solr
      # Define SOLR_HOME
      export SOLR_HOME=/opt/lucidworks-hdpsearch/solr/
      # Set to true if Kerberos is enabled
      export SECURITY_ENABLED=true 

   2. Create a collection.
      For example:

      su $SOLR_USER -c "$SOLR_HOME/bin/solr create -c bro -d $METRON_HOME/config/schema/bro/"
      

   3. Pull all configurations from ZooKeeper to the Metron config directory:

      $METRON_HOME/bin/zk_load_configs.sh -m PULL -z $ZOOKEEPER -o $METRON_HOME/config/zookeeper -f

4. From Ambari, select Metron in the components panel.
5. Click the Configs tab, then click the Rest tab.
6. Populate the following fields with the appropriate information:

   Source Type Field Name

   The source type field name used in the real-time store. Defaults to source:type.

   Threat Triage Score Field Name

   The threat triage score field name used in the real-time store. Defaults to threat.triage.score.

7. Restart Metron.
8. Start Solr.
9. From Ambari, select Metron in the components panel.
10. Click the Configs tab, then click the Indexing tab.
11. Choose Solr in the Index Writer - Random Access pull down menu.
    
12. Click Save.
13. From Ambari, stop and restart the Metron Alerts user interface.
14. From Ambari, stop and restart Metron REST.