You either want a MAP_GET in your IF or a match statement in there I expect. See the match statement at https://github.com/apache/metron/blob/master/metron-stellar/stellar-common/README.md under core functions (it’s relatively new)
Simon Sent from my iPhone > On 9 Feb 2018, at 03:55, Ali Nazemian <alinazem...@gmail.com> wrote: > > Hi All, > > I was wondering how we can address if statement in the config section to have > a different mapping in certain conditions. The following syntax is not > acceptable. > > { > "parserClassName": "org.apache.metron.parsers.asa.BasicAsaParser", > "filterClassName": null, > "sensorTopic": "test-asa", > "writerClassName": null, > "errorWriterClassName": null, > "invalidWriterClassName": null, > "parserConfig": {}, > "fieldTransformations": [ > { > "input": [], > "output": [ > "x", > "y", > "z", > ], > "transformation": "STELLAR", > "config": { > IF "ip_src_port" == 39296 THEN > "x": "something", > "y": "something else" > > ELSE > "y": "something", > "z": "something else" > } > } > ] > } > > Regards, > Ali