Github user justinleet commented on a diff in the pull request:
https://github.com/apache/metron/pull/718#discussion_r135507857
--- Diff: metron-platform/metron-parsers/README.md ---
@@ -212,6 +212,49 @@ into `{ "protocol" : "TCP", "source.type" : "bro",
...}`
* `STELLAR` : This transformation executes a set of transformations
expressed as [Stellar Language](../metron-common) statements.
+### Assignment to `null`
+
+If, in your field transformation, you assign a field to `null`, the field
will be removed.
+You can use this capability to rename variables.
+
+Consider this example:
+```
+ "fieldTransformations" : [
+ { "transformation" : "STELLAR"
+ ,"output" : [ "new_field", "old_field"]
+ ,"config" : {
+ "new_field" : "old_field"
+ ,"old_field" : "null"
+ }
+ }
+ ]
+```
+This would set `new_field` to the value of `old_field` and remove
`old_field`.
+
+### Warning: Transforming the same field twice
+
+Currently, the stellar expressions are expressed in the form of a map
where the keys define
+the fields and the values define the Stellar expressions. You order the
expression evaluation
+in the `output` field. A consequence of this choice to store the
assignments as a map is that
+the same field cannot appear in the map as a key twice.
+
+For instance, the following will not function as expected:
--- End diff --
I think this should be reworded. It's not that it doesn't function as
expected; that would imply a bug or an improvement that needs to happen.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
