Details
-
Improvement
-
Status: To Do
-
Major
-
Resolution: Unresolved
-
None
-
None
-
None
Description
Per discussion on https://github.com/apache/metron/pull/1099, we should allow Ambari to accept quoted parser groups in order to allow for parser aggregation (including possibly doing aggregation on a default flow).
A possible way to express this is something like
```
bro,"snort,yaf"
```
to signify
- Running Bro as its own topology
- Running Snort + Yaf as an aggregated topology.