[
https://issues.apache.org/jira/browse/METRON-1341?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16283462#comment-16283462
]
ASF GitHub Bot commented on METRON-1341:
----------------------------------------
Github user ottobackwards commented on the issue:
https://github.com/apache/metron/pull/861
I trying to run this up in full dev. I have two issues:
1. expressJS is failing download, obviously outside this PR
2. The usability of this transform. If a user just wants a couple of
fields, then no problem, but If they want anything more than that, then
selecting all the fields that they want seems like a bit of a chore. So if
they want to select *most* of the fields, they have to list them all out. It
seems tough. I wonder if we don't need regex support or something.
Thoughts?
> Projection FieldTransformation
> ------------------------------
>
> Key: METRON-1341
> URL: https://issues.apache.org/jira/browse/METRON-1341
> Project: Metron
> Issue Type: Improvement
> Affects Versions: 0.4.2
> Reporter: Simon Elliston Ball
> Assignee: Simon Elliston Ball
> Labels: newbie
>
> It would be useful to have a projection transformation for Parsers which
> could use configured to limit the fields output from the parser.
> The configuration would look like this:
> {code:java}
> {
> "fieldTransformations": [
> {
> "transformation": "STELLAR",
> "config": [
> "ipSrc = TRIM(raw_ip_src)"
> "ip_src_addr := ipSrc"
> ]
> },
> {
> "transformation": "SELECT",
> "output" : [ "ip_src_addr", "ip_dst_addr", "message"]
> }
> ]
> }
> {code}
> This would lead to only the fields in the output definition of the SELECT
> transformation being put into the outbound message.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
