hillar / pigsty-moloch-plugin Goto Github PK

Hi guys, I'm sorry for my English. I installed pigsty with node version 0.10.48. I tried to run pigsty and it's successfull, but when i installed pigsty moloch plugin, i must changed node version on 4.8.2, because i got error with hashtable(with version 0.10.48).

$ pigsty
[-] Pigsty is starting up...
[!] There was a problem installing the output plugin: pigsty-moloch-plugin
[!] Error was: { [Error: Cannot find module 'pigsty-moloch-plugin'] code: 'MODULE_NOT_FOUND' }
[!] Do you have the plugin installed? Try doing: npm install pigsty-moloch-plugin -g
[!] Have a special day. ♥

$ git clone https://github.com/hillar/pigsty-moloch-plugin.git
$ cd pigsty-moloch-plugin/

$ n 4
root@projekt:/usr/local/lib/node_modules/pigsty/pigsty-moloch-plugin# node -v
v4.8.2

$ npm install
$ npm WARN package.json [email protected] No license field.

[email protected] install /usr/local/lib/node_modules/pigsty/pigsty-moloch-plugin/node_modules/hashtable
node-gyp configure build

make: Entering directory '/usr/local/lib/node_modules/pigsty/pigsty-moloch-plugin/node_modules/hashtable/build'
CXX(target) Release/obj.target/native/src/hashtable.o
SOLINK_MODULE(target) Release/obj.target/native.node
COPY Release/native.node
make: Leaving directory '/usr/local/lib/node_modules/pigsty/pigsty-moloch-plugin/node_modules/hashtable/build'
[email protected] node_modules/hashtable
└── [email protected]

And when node version is changed to 4.8.2 and i run pigsty, this is output :

$ pigsty
/usr/local/lib/node_modules/pigsty/node_modules/bindings/bindings.js:83
throw e
^

Error: Module did not self-register.
at Error (native)
at Object.Module._extensions..node (module.js:434:18)
at Module.load (module.js:343:32)
at Function.Module._load (module.js:300:12)
at Module.require (module.js:353:17)
at require (internal/module.js:12:17)
at bindings (/usr/local/lib/node_modules/pigsty/node_modules/bindings/bindings.js:76:44)
at Object. (/usr/local/lib/node_modules/pigsty/node_modules/ref/lib/ref.js:5:47)
at Module._compile (module.js:409:26)
at Object.Module._extensions..js (module.js:416:10)

When i changed version to 0.10.48, my output is follow:
$ pigsty
[-] Pigsty is starting up...
[!] There was a problem installing the output plugin: pigsty-moloch-plugin
[!] Error was: { [Error: Cannot find module 'pigsty-moloch-plugin'] code: 'MODULE_NOT_FOUND' }
[!] Do you have the plugin installed? Try doing: npm install pigsty-moloch-plugin -g
[!] Have a special day. ♥

[created a GH account to post]

While testing in my lab, I found the plugin was unable to update documents in ES (complained of an Elasticsearch error "null+=null") . The issue wound up being the "ta" field did not yet exist in the document source in each case since my sessions had no tags to start with. I updated line 435 of plugin.js accordingly to check for existence and create as necessary

var _document = { script: "if (!ctx._source.containsKey(\"ta\")) { ctx._source.ta = ta } else { ctx._source.ta += ta }", params: { ta: _results.tags } };

...and it works a treat! Thanks alot for your work on this. It's going to be a big help for us.

.

I could be really silly, but I think it's broken right now :(.

Awesome log:
[-] Pigsty is starting up...

/data/moloch/viewer/db.js:83
return cb();
^
TypeError: undefined is not a function
at /data/moloch/viewer/db.js:83:12
at respond (/data/moloch/viewer/node_modules/elasticsearch/src/lib/transport.js:255:9)
at checkRespForFailure (/data/moloch/viewer/node_modules/elasticsearch/src/lib/transport.js:202:7)
at HttpConnector. (/data/moloch/viewer/node_modules/elasticsearch/src/lib/connectors/http.js:148:7)
at IncomingMessage.bound (/data/moloch/viewer/node_modules/elasticsearch/node_modules/lodash-node/modern/internals/baseBind.js:56:17)
at IncomingMessage.EventEmitter.emit (events.js:117:20)
at _stream_readable.js:919:16
at process._tickCallback (node.js:419:13)

Error: Cannot find module 'pigsty-plugin'] code: 'MODULE_NOT_FOUND