Hi,
- For some reason my bad rows don’t get populated, I mentioned it here and it seems to be an issue with previous version of snowplow. But since the data is present in enriched s3 bucket for that schema, I don’t think it is the case of schema violations.
- I restarted enrich, didn’t solve the issue, then re-run the terraform modules checking all the parameters, still no luck.
I tried uploading other simple schemas to check if the problem is with the schema uploaded earlier, but simple schema is also not reflected in db. So I think the issue is not with schema.
What other things I can test regarding this?
I found some warnings in collector server logs, these have multiple instances in logs:
[scala-stream-collector-akka.actor.default-dispatcher-7] WARN akka.actor.ActorSystemImpl - Illegal header: Illegal 'host' header: Invalid input '{', expected 'EOI', ':', UPPER_ALPHA, lower-reg-name-char or pct-encoded (line 1, column 2): ${ip}
[scala-stream-collector-akka.actor.default-dispatcher-7] WARN akka.actor.ActorSystemImpl - Illegal request, responding with status '400 Bad Request': Request is missing required `Host` header
[scala-stream-collector-akka.actor.default-dispatcher-12] WARN akka.actor.ActorSystemImpl - Illegal header: Illegal 'host' header: Invalid input '{', expected 'EOI', ':', UPPER_ALPHA, lower-reg-name-char or pct-encoded (line 1, column 2): ${ip}
[scala-stream-collector-akka.actor.default-dispatcher-12] WARN akka.actor.ActorSystemImpl - Illegal request, responding with status '400 Bad Request': Request is missing required `Host` header
[scala-stream-collector-akka.actor.default-dispatcher-11] WARN akka.actor.ActorSystemImpl - Illegal header: Illegal 'user-agent' header: Invalid input ',', expected OWS, 'EOI', tchar, product-or-comment, comment or ws (line 1, column 5): xfa1,nvdorz
[scala-stream-collector-akka.actor.default-dispatcher-12] WARN akka.actor.ActorSystemImpl - Illegal header: Illegal 'user-agent' header: Invalid input ',', expected OWS, 'EOI', tchar, product-or-comment, comment or ws (line 1, column 8): Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com