Hi All,
I was wondering how we can address if statement in the config section to
have a different mapping in certain conditions. The following syntax is not
acceptable.
{
"parserClassName": "org.apache.metron.parsers.asa.BasicAsaParser",
"filterClassName": null,
"sensorTopic": "test-asa",
"writerClassName": null,
"errorWriterClassName": null,
"invalidWriterClassName": null,
"parserConfig": {},
"fieldTransformations": [
{
"input": [],
"output": [
"x",
"y",
"z",
],
"transformation": "STELLAR",
"config": {
IF "ip_src_port" == 39296 THEN
"x": "something",
"y": "something else"
ELSE
"y": "something",
"z": "something else"
}
}
]
}
Regards,
Ali