Thanks, Nick. How can I make sure that the second enrichment (renaming) will be applied after the first enrichment? However, the naming policy would be more efficient because we don't need to put duplicate data inside Elasticsearch and HBase.
On Mon, Apr 3, 2017 at 1:00 AM, Nick Allen <n...@nickallen.org> wrote: > One way to do it is just to create another enrichment specific to source 3 > where... > > computer_name = enrichments.hbaseEnrichments.computer_name > > I am unsure off hand if you can change the root name for an Hbase > enrichment. If not, we should make that happen. > > > > On Apr 2, 2017 10:30 AM, "Ali Nazemian" <alinazem...@gmail.com> wrote: > > Hi all, > > How can I change the default attribute naming inside Metron? > > I want to normalize the Metron JSON object across several sources. > However, some of the sources do not provide specific attributes in the > primary feed. For example, I want to know the computer name across all > sources. Two of the sources may have computer name, while the third I > will need to do an enrichment with data in HBASE. I end up with three > attributes such as: > > · Source 1: computer_name:x > > · Source 2: computer_name:x > > · Source 3: enrichments.hbaseEnrichments.computer_name:x > > I want to have all three called computer_name so they may be used for > future correlation use cases, indexing and displaying in UI consistently. > How would this best be achieved? > > Cheers, > Ali > > > -- A.Nazemian
