One way to do it is just to create another enrichment specific to source 3 where...
computer_name = enrichments.hbaseEnrichments.computer_name I am unsure off hand if you can change the root name for an Hbase enrichment. If not, we should make that happen. On Apr 2, 2017 10:30 AM, "Ali Nazemian" <alinazem...@gmail.com> wrote: Hi all, How can I change the default attribute naming inside Metron? I want to normalize the Metron JSON object across several sources. However, some of the sources do not provide specific attributes in the primary feed. For example, I want to know the computer name across all sources. Two of the sources may have computer name, while the third I will need to do an enrichment with data in HBASE. I end up with three attributes such as: · Source 1: computer_name:x · Source 2: computer_name:x · Source 3: enrichments.hbaseEnrichments.computer_name:x I want to have all three called computer_name so they may be used for future correlation use cases, indexing and displaying in UI consistently. How would this best be achieved? Cheers, Ali
