i think it would be great if we had something like this.  I can see lots of 
people needing this 

27.09.2016, 11:39, "Casey Stella" <[email protected]>:
> Just as an aside, I was thinking that it might be nice to have a special
> THIS object in stellar which would return the current message being
> processed, so you could do stuff like MAP_REMOVE('foo', this) to remove a
> field.
>
> On Tue, Sep 27, 2016 at 2:33 PM, Casey Stella <[email protected]> wrote:
>
>>  Yes, it is in the parser. You can assign a field to NULL and it will
>>  remove it.
>>
>>  Consider the following example parser config which takes the foo field and
>>  renames it to bar:
>>
>>  {
>>    "parserClassName":"org.apache.metron.parsers.json.JSONMapParser",
>>    "sensorTopic":"custom",
>>    "parserConfig" : {
>>      "mapStrategy" : "UNFOLD"
>>    },"fieldTransformations" : [
>>      {
>>        "transformation" : "STELLAR"
>>      ,"output" : [ "bar", "foo" ]
>>      ,"config" : {
>>        "bar" : "foo"
>>        ,"foo" : "NULL"
>>                  }
>>      }
>>                             ]
>>  }
>>
>>  Note the output section, that defines the order in which the stellar
>>  statements are executed. You first set bar to whatever is in foo. Then
>>  you set foo to NULL, which will delete it. You will be left with just bar,
>>  which will contain what is in foo.
>>
>>  Another way to do this is to use the REMOVE transformation
>>  
>> <https://github.com/apache/incubator-metron/tree/master/metron-platform/metron-parsers#fieldtransformation-configuration>
>>  in
>>  combination with the stellar transformation:
>>  {
>>    "parserClassName":"org.apache.metron.parsers.json.JSONMapParser",
>>    "sensorTopic":"custom",
>>    "parserConfig" : {
>>      "mapStrategy" : "UNFOLD"
>>    },"fieldTransformations" : [
>>      {
>>        "transformation" : "STELLAR"
>>      ,"output" : [ "bar", "foo" ]
>>      ,"config" : {
>>        "bar" : "foo"
>>                  }
>>      },
>>      {
>>        "input" : "foo"
>>       , "transformation" : "REMOVE"
>>      }
>>                             ]
>>  }
>>
>>  Best,
>>
>>  Casey
>>
>>  On Tue, Sep 27, 2016 at 2:12 PM, Otto Fowler <[email protected]>
>>  wrote:
>>
>>>  Is it possible to remove and rename fields with stellar?
>>>  I have “foreign” json coming out of the JSONParser, and I need to rename
>>>  some fields to the core metron json object names and possibly remove some
>>>  other fields.

------------------- 
Thank you,

James Sirota
PPMC- Apache Metron (Incubating)
jsirota AT apache DOT org

Reply via email to