nielsbasjes edited a comment on pull request #2122: URL: https://github.com/apache/drill/pull/2122#issuecomment-740519480
@cgivre How should the type remapping feature be defined in drill? In the logparser you have a field like for example the query string parameter `ua` in the field `request.firstline.uri.query.ua` You can then remap it to a new type like `HTTP.USERAGENT` and then any Dissector that can handle the input of type `HTTP.USERAGENT` will provide additional results. So the normal flow is that you tell the logparser about the remapping remap `request.firstline.uri.query.ua` to `HTTP.USERAGENT` and then if you ask for all possible columns it should give you a lot more than before. So in the end I expect to have Drill columns like (with the flatten wildcards enabled) `request_firstline_uri_query_ua_agent__name__version__major` How do I do that? I have not been able to figure it out from the code and documentation. I added test at my end to illustrate: https://github.com/nielsbasjes/yauaa/blob/master/udfs/logparser/src/test/java/nl/basjes/parse/useragent/dissector/TestLoadDissectorDynamicallyInPig.java#L52 Parsing this logfile https://github.com/nielsbasjes/yauaa/blob/master/udfs/logparser/src/test/resources/access.log Here the `ua` query parameter is parsed as a useragent. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
