Just as an aside, I was thinking that it might be nice to have a special
THIS object in stellar which would return the current message being
processed, so you could do stuff like MAP_REMOVE('foo', this) to remove a
field.On Tue, Sep 27, 2016 at 2:33 PM, Casey Stella <[email protected]> wrote: > Yes, it is in the parser. You can assign a field to NULL and it will > remove it. > > Consider the following example parser config which takes the foo field and > renames it to bar: > > { > "parserClassName":"org.apache.metron.parsers.json.JSONMapParser", > "sensorTopic":"custom", > "parserConfig" : { > "mapStrategy" : "UNFOLD" > },"fieldTransformations" : [ > { > "transformation" : "STELLAR" > ,"output" : [ "bar", "foo" ] > ,"config" : { > "bar" : "foo" > ,"foo" : "NULL" > } > } > ] > } > > Note the output section, that defines the order in which the stellar > statements are executed. You first set bar to whatever is in foo. Then > you set foo to NULL, which will delete it. You will be left with just bar, > which will contain what is in foo. > > Another way to do this is to use the REMOVE transformation > <https://github.com/apache/incubator-metron/tree/master/metron-platform/metron-parsers#fieldtransformation-configuration> > in > combination with the stellar transformation: > { > "parserClassName":"org.apache.metron.parsers.json.JSONMapParser", > "sensorTopic":"custom", > "parserConfig" : { > "mapStrategy" : "UNFOLD" > },"fieldTransformations" : [ > { > "transformation" : "STELLAR" > ,"output" : [ "bar", "foo" ] > ,"config" : { > "bar" : "foo" > } > }, > { > "input" : "foo" > , "transformation" : "REMOVE" > } > ] > } > > Best, > > Casey > > On Tue, Sep 27, 2016 at 2:12 PM, Otto Fowler <[email protected]> > wrote: > >> Is it possible to remove and rename fields with stellar? >> I have “foreign” json coming out of the JSONParser, and I need to rename >> some fields to the core metron json object names and possibly remove some >> other fields. >> > >
