[
https://issues.apache.org/jira/browse/METRON-1643?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16534132#comment-16534132
]
ASF GitHub Bot commented on METRON-1643:
----------------------------------------
Github user cestella commented on the issue:
https://github.com/apache/metron/pull/1083
Sure, so the difference in the parser chaining example would be between the
following
# Stellar
```
"fieldTransformations" : [
{
"transformation" : "STELLAR"
,"input" : "pix_type"
,"output" : "logical_source_type"
,"config" : {
"logical_source_type" : "match{REGEXP_MATCH(pix_type, '^6-302.*') =>
'cisco-6-302', REGEXP_MATCH(pix_type, '^5-304.*') => 'cisco-5-304', default =>
NULL}",
}
}
]
```
# `REGEX_SELECT`
```
"fieldTransformations" : [
{
"transformation" : "REGEX_SELECT"
,"input" : "pix_type"
,"output" : "logical_source_type"
,"config" : {
"cisco-6-302" : "^6-302.*",
"cisco-5-304" : "^5-304.*"
}
}
]
```
It bears mentioning that things get worse in stellar when:
1. You want to match on one of a set of regexs (e.g. `match {
REGEXP_MATCH(pix_type, 'regex1') or REGEXP_MATCH(pix_type, 'regex2') => 'foo',
...`)
2. The set of target kafka topics grows. In this example there are 2, but
if there were 5, they'd all have to fit in a long line of stellar.
I think it's not that stellar isn't equipped to handle it theoretically,
it's just that for these kinds of use-cases, it's more readable to create
something a bit more specific until we get multi-line Stellar available.
Ultimately, I consider this a stop-gap.
> Create a REGEX_ROUTING field transformation
> -------------------------------------------
>
> Key: METRON-1643
> URL: https://issues.apache.org/jira/browse/METRON-1643
> Project: Metron
> Issue Type: Improvement
> Reporter: Casey Stella
> Priority: Major
>
> A relatively common pattern is to choose the value of a field based on if
> another field matches a set of regexes. This can be done via stellar with
> match, but if the list of possible regexes are large, that can be unwieldy.
> To ease that burden, we should have a REGEX_ROUTING field transformation.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
