You either want a MAP_GET in your IF or a match statement in there I expect.
See the match statement at
https://github.com/apache/metron/blob/master/metron-stellar/stellar-common/README.md
under core functions (it’s relatively new)
Simon
Sent from my iPhone
> On 9 Feb 2018, at 03:55, Ali Nazemian <alinazem...@gmail.com> wrote:
>
> Hi All,
>
> I was wondering how we can address if statement in the config section to have
> a different mapping in certain conditions. The following syntax is not
> acceptable.
>
> {
> "parserClassName": "org.apache.metron.parsers.asa.BasicAsaParser",
> "filterClassName": null,
> "sensorTopic": "test-asa",
> "writerClassName": null,
> "errorWriterClassName": null,
> "invalidWriterClassName": null,
> "parserConfig": {},
> "fieldTransformations": [
> {
> "input": [],
> "output": [
> "x",
> "y",
> "z",
> ],
> "transformation": "STELLAR",
> "config": {
> IF "ip_src_port" == 39296 THEN
> "x": "something",
> "y": "something else"
>
> ELSE
> "y": "something",
> "z": "something else"
> }
> }
> ]
> }
>
> Regards,
> Ali
