[
https://issues.apache.org/jira/browse/METRON-1644?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16535097#comment-16535097
]
ASF GitHub Bot commented on METRON-1644:
----------------------------------------
Github user cestella commented on the issue:
https://github.com/apache/metron/pull/1084
@ottobackwards Ok, I attempted to do that
[here](https://github.com/cestella/incubator-metron/blob/c4e4786e778d5b06cd16f7faa7d3522f620fc2ba/metron-platform/metron-parsers/ParserChaining.md).
Can you help me understand where the gaps are. Is it one or more of the
following:
[ ] The document doesn't have enough detail about what was done before,
just detail about the current architecture.
[ ] The document does not link to relevant code examples to create custom
raw message strategies.
[ ] The document is too high level
[ ] The document is too low level
[ ] Other. Please specify details if this is checked.
> Support parser chaining
> -----------------------
>
> Key: METRON-1644
> URL: https://issues.apache.org/jira/browse/METRON-1644
> Project: Metron
> Issue Type: Improvement
> Reporter: Casey Stella
> Priority: Major
>
> Currently we have only one layer of parsing prior to enrichment, but often
> real data is more complex. For instance, often data is wrapped in an
> envelope (e.g. syslog data which contains a field which needs to be parsed).
> This Jira allows us to support a DAG of parsers prior to enrichment by
> allowing us to provide a strategy for interpreting what is data and what is
> metadata in the parser bolt. This enables upstream parsers to pass in a JSON
> Blob which contains the metadata and have the parser bolt choose which field
> is the data to be parsed, the remaining fields would be considered metadata
> (and merged into the resulting data or not depending on our existing rules
> for handling metadata).
>
> To illustrate this better, I've provided a use-case with an example. Note,
> this PR depends on METRON-1643 and METRON-1642, so those should be reviewed
> prior to this.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
