It's described in https://github.com/apache/incubator-metron/tree/master/ metron-platform/metron-parsers#fieldtransformation-configuration under "REMOVE". The wiki tends to lag; the README.md docs are mostly up-to-date.
Casey On Tue, Sep 27, 2016 at 2:47 PM, Otto Fowler <[email protected]> wrote: > I’m going by the wiki and REMOVE is not in there. Where should I look for > the most up to date stuff? The unit tests? > > > > On September 27, 2016 at 14:33:08, Casey Stella ([email protected]) > wrote: > > Yes, it is in the parser. You can assign a field to NULL and it will > remove it. > > Consider the following example parser config which takes the foo field and > renames it to bar: > > { > "parserClassName":"org.apache.metron.parsers.json.JSONMapParser", > "sensorTopic":"custom", > "parserConfig" : { > "mapStrategy" : "UNFOLD" > },"fieldTransformations" : [ > { > "transformation" : "STELLAR" > ,"output" : [ "bar", "foo" ] > ,"config" : { > "bar" : "foo" > ,"foo" : "NULL" > } > } > ] > } > > Note the output section, that defines the order in which the stellar > statements are executed. You first set bar to whatever is in foo. Then > you set foo to NULL, which will delete it. You will be left with just bar, > which will contain what is in foo. > > Another way to do this is to use the REMOVE transformation > < > https://github.com/apache/incubator-metron/tree/master/ > metron-platform/metron-parsers#fieldtransformation-configuration> > > in > combination with the stellar transformation: > { > "parserClassName":"org.apache.metron.parsers.json.JSONMapParser", > "sensorTopic":"custom", > "parserConfig" : { > "mapStrategy" : "UNFOLD" > },"fieldTransformations" : [ > { > "transformation" : "STELLAR" > ,"output" : [ "bar", "foo" ] > ,"config" : { > "bar" : "foo" > } > }, > { > "input" : "foo" > , "transformation" : "REMOVE" > } > ] > } > > Best, > > Casey > > On Tue, Sep 27, 2016 at 2:12 PM, Otto Fowler <[email protected]> > wrote: > > > Is it possible to remove and rename fields with stellar? > > I have “foreign” json coming out of the JSONParser, and I need to rename > > some fields to the core metron json object names and possibly remove some > > other fields. > > >
