metron-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From cestella <...@git.apache.org>
Subject [GitHub] incubator-metron issue #333: METRON-249: Field Transformation functions fail...
Date Mon, 31 Oct 2016 20:32:27 GMT
Github user cestella commented on the issue:

    https://github.com/apache/incubator-metron/pull/333
  
    @ottobackwards Thanks so much for the review.  
    
    Yeah, it's a general question about stellar functions about when to error versus when
to tolerate.  We have traditionally tried to be as permissive as possible about errors that
are associated with missing data.  I think you can make an argument for malformed URLs to
be a proper error, but it has historically not been mostly because it was considered a semantic
error.  The original concern was you might want to transform fields which were inconsistently
populated or populated with default values some of the time.  In that case, if the field is
malformed then the URL that it produced should be `null`.  You still have the original field
and can make decisions downstream in enrichment or threat triage.
    
    Contrasting that would be syntactic or systemic errors, like passing in a number when
you intended a string.  These would indicate a high likelihood of misconfiguration, so should
be errors.  This was the original thinking behind when stellar functions error and when they
tolerate variable input.
    
    I think it is high time to provide an `EXCEPTION` function so you can choose to throw
an exception under certain circumstances if you want a more conservative interpretation of
error.


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

Mime
View raw message