[
https://issues.apache.org/jira/browse/METRON-1415?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Laurens Vets reassigned METRON-1415:
------------------------------------
Assignee: Otto Fowler (was: Laurens Vets)
> match statement does not seem to work.
> --------------------------------------
>
> Key: METRON-1415
> URL: https://issues.apache.org/jira/browse/METRON-1415
> Project: Metron
> Issue Type: Bug
> Affects Versions: 0.4.2
> Reporter: Laurens Vets
> Assignee: Otto Fowler
> Priority: Major
>
> I had the following code in my Sensor Enrichment Config:
> {code:java}
> {
> "enrichment": {
> "fieldMap": {
> "stellar": {
> "config": {
> "AWSEventSourceAccount": "match{recipientAccountID ==
> 1111111111L => 'account1', recipientAccountID == 2222222222L => 'account2',
> recipientAccountID == 333333333L => 'account3', recipientAccountID ==
> 4444444444L => 'account4', recipientAccountID == 5555555555L => 'account4',
> recipientAccountID == 6666666666L => 'account6', default => 'Unknown
> Account.'}"
> }
> }
> },
> "fieldToTypeMap": {},
> "config": {}
> },{code}
> However, this did not work as expected and the AWSEventSourceAccount field
> would always return "Unknown Account" in my events.
> According to [~ottobackwards], this does work in the Stellar shell. He asked
> me to test with "_source.recipientAccountID" instead of "recipientAccountID"
> and make sure that mapStrategy is set to UNFOLD (this was already the case).
> However, using this in my enrichment config does not resolve the issue. I
> used:
> {code:java}
> {
> "enrichment": {
> "fieldMap": {
> "stellar": {
> "config": {
> "AWSEventSourceAccount":
> "match{_source.recipientAccountID == 1111111111L => 'account1',
> _source.recipientAccountID == 2222222222L => 'account2',
> _source.recipientAccountID == 333333333L => 'account3',
> _source.recipientAccountID == 4444444444L => 'account4',
> _source.recipientAccountID == 5555555555L => 'account4',
> _source.recipientAccountID == 6666666666L => 'account6', default => 'Unknown
> Account.'}"
> }
> }
> },
> "fieldToTypeMap": {},
> "config": {}
> },{code}
>
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
