Simon Elliston Ball created METRON-1341:
-------------------------------------------
Summary: Projection FieldTansformation
Key: METRON-1341
URL: https://issues.apache.org/jira/browse/METRON-1341
Project: Metron
Issue Type: Improvement
Affects Versions: 0.4.2
Reporter: Simon Elliston Ball
Assignee: Simon Elliston Ball
It would be useful to have a projection transformation for Parsers which could
use configured to limit the fields output from the parser.
The configuration would look like this:
{code:java}
{
"fieldTransformations": [
{
"transformation": "STELLAR",
"config": [
"ipSrc = TRIM(raw_ip_src)"
"ip_src_addr := ipSrc"
]
},
{
"transformation": "SELECT",
"output" : [ "ip_src_addr", "ip_dst_addr", "message"]
}
]
}
{code}
This would lead to only the fields in the output definition of the SELECT
transformation being put into the outbound message.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
