metron-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From nickwallen <...@git.apache.org>
Subject [GitHub] incubator-metron issue #438: METRON-686 Record Rule Set that Fired During Th...
Date Wed, 22 Feb 2017 15:50:38 GMT
Github user nickwallen commented on the issue:

    https://github.com/apache/incubator-metron/pull/438
  
    One thing to consider is that we have other enrichments, like the `GEO_GET` function,
that add a complex type (map) to the message.  So right now, that functionality is in the
same boat as this PR.
    
    I like the trend that was introduced (or reinforced?) by `GEO_GET`.  That is moving enrichments
from custom code to Stellar.  I don't think it makes sense to require all sources of enrichment
(like `GEO_GET`) to flatten the data that it produces.  I think doing see places an unfair
burden on our users.
    
    
    
    
    



---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

Mime
View raw message