Hortonworks Cybersecurity Platform
Also available as:
loading table of contents...

Invalidation Errors

There are two reasons that a message will be marked as invalid. Either the parser fails its global validation or the parser fails the validation function.

Parser messages that are marked as invalid are sent to the error queue with an indication that they are invalid in the error message.
Parser fails global validation

The global configuration validates messages coming from all parsers. This is done in the form of validation plugins where assertions about fields or whole messages can be made. For more information about defining fieldValidations, see Create Global Configurations.

Parser fails the validation function
If a parser fails the validation function, this typicallyi means it does not have a timestamp field or original_string field.

There are two types of events. One, where the event could not be parsed at all. Two, where the event was parsed, but failed validation.