Github user simonellistonball commented on the issue:
https://github.com/apache/metron/pull/861
A typical case might be something like the CEF parser. You could
potentially kick out a lot of fields you really don't care about, which at
scale can produce huge amounts of ES and HDFS storage (in addition to the
original_string representation. The goal for this is to focus on just
outputting fields which match active use cases in the rest of the flow to
control data storage costs and data clarity.
This also allows you to map an explicit data model and provide some
governability to the data model.
---
