[ https://issues.apache.org/jira/browse/METRON-1569?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16490876#comment-16490876 ]
ASF GitHub Bot commented on METRON-1569: ---------------------------------------- Github user nickwallen commented on the issue: https://github.com/apache/metron/pull/1022 FYI - I also confirmed that the configuration value can be changed using the Advanced mode in the Management UI. ![screen shot 2018-05-25 at 11 31 17 am](https://user-images.githubusercontent.com/2475409/40552989-53c6a118-600f-11e8-9b03-4cadf351d641.png) > Allow user to change field name conversion when indexing to Elasticsearch > ------------------------------------------------------------------------- > > Key: METRON-1569 > URL: https://issues.apache.org/jira/browse/METRON-1569 > Project: Metron > Issue Type: Improvement > Reporter: Nick Allen > Assignee: Nick Allen > Priority: Major > > The `ElasticsearchWriter` has a mechanism to transform the field names of a > message before it is written to Elasticsearch. Right now this mechanism is > hard-coded to replace all '.' dots with ':' colons. > This mechanism was needed for Elasticsearch 2.x which did not allow dots in > field names. Now that Metron supports Elasticsearch 5.x this is no longer a > problem. > A user should be able to configure the field name transformation when writing > to Elasticsearch, as needed. > While it might have been simpler to just remove the de-dotting mechanism, > this would break backwards compatibility. Providing users with a means to > configure this mechanism provides them with an upgrade path. > > -- This message was sent by Atlassian JIRA (v7.6.3#76005)