Github user justinleet commented on a diff in the pull request:
https://github.com/apache/metron/pull/530#discussion_r121161467
--- Diff:
metron-extensions/metron-parser-extensions/metron-parser-bro-extension/metron-parser-bro/src/main/config/zookeeper/enrichments/bro.json
---
@@ -0,0 +1,17 @@
+{
+ "enrichment" : {
--- End diff --
I'm tending to lean towards being able to package up the whole thing on
this, if only because it doesn't seem to have a lot of meaning to just pack up
a parser without actually doing anything downstream. As long as the downstream
stuff is overridable (and since it's ZK stuff, it should be), I'm not terribly
concerned if we provide semi-reasonable defaults (I mean, we are already,
right?)
Otherwise, we're just shifting the burden of defining this stuff elsewhere,
where it's less logically related, imo.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
