When we encounter this problem in things like enrichment, we’ve generally re-written the dots to ‘:’ at the indexing stage, no? That should be fine, which would suggest the cleaner is being over enthusiastic in this limit, may be worth validating that before changing the parser.
Simon > On 9 May 2017, at 14:41, zeo...@gmail.com <zeo...@gmail.com> wrote: > > Is there a reason why the bro parser allows periods > <https://github.com/apache/incubator-metron/blob/master/metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/bro/JSONCleaner.java#L56> > in the keys if we can't index it (ES 2.3.3 does not allow periods in > indexes)? Would anybody be opposed to me modifying the bro parser to > rewrite "."s to "_"s for the short term, until we get ES upgraded > <https://issues.apache.org/jira/browse/METRON-939>? > > Jon > -- > > Jon
