Hi all, How can I change the default attribute naming inside Metron?
I want to normalize the Metron JSON object across several sources. However, some of the sources do not provide specific attributes in the primary feed. For example, I want to know the computer name across all sources. Two of the sources may have computer name, while the third I will need to do an enrichment with data in HBASE. I end up with three attributes such as: · Source 1: computer_name:x · Source 2: computer_name:x · Source 3: enrichments.hbaseEnrichments.computer_name:x I want to have all three called computer_name so they may be used for future correlation use cases, indexing and displaying in UI consistently. How would this best be achieved? Cheers, Ali
