[ 
https://issues.apache.org/jira/browse/METRON-424?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15572384#comment-15572384
 ] 

ASF GitHub Bot commented on METRON-424:
---------------------------------------

Github user cestella commented on the issue:

    https://github.com/apache/incubator-metron/pull/303
  
    Yeah, I agree.  I'd like to have a sensor-specific validator as well as a 
global validator.  Right now we have a `MessageFilter`, but it's slightly 
different in intent.  It is intended to pick out which messages we want to pass 
through the parser and drop those that don't meet the criteria.  I'd like to 
see all of these concepts merged into a mapping between stellar statements and 
actions (i.e. DROP, REDIRECT_TO_INVALID, REDIRECT_TO_ERROR) and have sensor 
specific as well as global versions of this.


> Stellar fieldValidation "IP" does not support list values
> ---------------------------------------------------------
>
>                 Key: METRON-424
>                 URL: https://issues.apache.org/jira/browse/METRON-424
>             Project: Metron
>          Issue Type: Bug
>            Reporter: Neha Sinha
>
> Currently, stellar fieldValidation *IP* accepts only single string 
> value.However we need the ability to specify a list of values,say, we want to 
> validate ip_dst_addr to be of either IPV4 or IPV6 type. This feature needs to 
> be incorporated.
> Desired Behaviour :- User should be able to configure ip validation as below 
> :-
> GLOBAL Config: global
> {
>   "es.clustername": "metron",
>   "es.ip": "metron-test1-10.openstacklocal",
>   "es.port": "9300",
>   "es.date.format": "yyyy.MM.dd.HH",
>   "fieldValidations" : [
>               {
>                 "input" : [ "ip_dst_addr" ],
>                 "validation" : "IP",
>                 "config" : {
>                     "type" : ["IPV6","IPV4"]
>                            }
>               }
>                        ]
> }



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Reply via email to