[
https://issues.apache.org/jira/browse/METRON-1341?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16283479#comment-16283479
]
ASF GitHub Bot commented on METRON-1341:
----------------------------------------
Github user simonellistonball commented on the issue:
https://github.com/apache/metron/pull/861
If they want to select most, and remove the ones they don't want, then I
would recommend using the remove transformation, or a set null in stellar.
Perhaps regex support might be a nice follow on, but it breaks the mental model
of people who are used to any other language that handles projection, such as
SQL. The goal for this was to allow user to explicitly select only a defined
set of fields. To be honest, people have lived with the idea of explicitly
choosing fields for decades in SQL and quite liked it, so I suspect adding
something that is pattern based might make it less usable than more.
> Projection FieldTransformation
> ------------------------------
>
> Key: METRON-1341
> URL: https://issues.apache.org/jira/browse/METRON-1341
> Project: Metron
> Issue Type: Improvement
> Affects Versions: 0.4.2
> Reporter: Simon Elliston Ball
> Assignee: Simon Elliston Ball
> Labels: newbie
>
> It would be useful to have a projection transformation for Parsers which
> could use configured to limit the fields output from the parser.
> The configuration would look like this:
> {code:java}
> {
> "fieldTransformations": [
> {
> "transformation": "STELLAR",
> "config": [
> "ipSrc = TRIM(raw_ip_src)"
> "ip_src_addr := ipSrc"
> ]
> },
> {
> "transformation": "SELECT",
> "output" : [ "ip_src_addr", "ip_dst_addr", "message"]
> }
> ]
> }
> {code}
> This would lead to only the fields in the output definition of the SELECT
> transformation being put into the outbound message.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
