[
https://issues.apache.org/jira/browse/METRON-1341?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16282577#comment-16282577
]
ASF GitHub Bot commented on METRON-1341:
----------------------------------------
Github user simonellistonball commented on a diff in the pull request:
https://github.com/apache/metron/pull/861#discussion_r155649024
--- Diff: metron-platform/metron-parsers/README.md ---
@@ -216,6 +216,23 @@ whenever `field2` exists and whose corresponding equal
to 'foo':
}
```
+* `SELECT`: This transformation filters the fields in the message to
include only the configured output fields, and drops any not explicitly
included.
+
+For example:
+```
+{
+...
+ "fieldTransformations" : [
+ {
+ "output" : ["field1", "field2" ]
+ , "transformation" : "SELECT"
+ }
+ ]
+}
+```
+
+when applied to a message containing keys field1, field2 and field3, will
only output the first two.
+
--- End diff --
Yes, that would break. I'd say that was flat out user error, and not
something to guard against, or indeed something it's possible to guard against.
I guess the key thing here is that it requires maintaining order in field
transformations.
> Projection FieldTransformation
> ------------------------------
>
> Key: METRON-1341
> URL: https://issues.apache.org/jira/browse/METRON-1341
> Project: Metron
> Issue Type: Improvement
> Affects Versions: 0.4.2
> Reporter: Simon Elliston Ball
> Assignee: Simon Elliston Ball
> Labels: newbie
>
> It would be useful to have a projection transformation for Parsers which
> could use configured to limit the fields output from the parser.
> The configuration would look like this:
> {code:java}
> {
> "fieldTransformations": [
> {
> "transformation": "STELLAR",
> "config": [
> "ipSrc = TRIM(raw_ip_src)"
> "ip_src_addr := ipSrc"
> ]
> },
> {
> "transformation": "SELECT",
> "output" : [ "ip_src_addr", "ip_dst_addr", "message"]
> }
> ]
> }
> {code}
> This would lead to only the fields in the output definition of the SELECT
> transformation being put into the outbound message.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
