metron-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Otto Fowler <>
Subject Re: [GitHub] incubator-metron issue #438: METRON-686 Record Rule Set that Fired During Th...
Date Fri, 10 Feb 2017 19:20:47 GMT
Could you re-use the jsonmap parser stuff?

On February 10, 2017 at 13:58:54, cestella ( wrote:

Github user cestella commented on the issue:

It occurs to me that one thing we might consider going forward is to
flatten the map upon writing to the index. We could configure the message
flattening as a capability on a per-writer basis. This would let us adjust
the message representation to the index.

We already have a hook to transform the messages (the `FieldNameConverter`
class). That being said, we'd have to have different hooks than just
`FieldNameConverter`, which just operates on field names. Instead, you'd
need a `FieldValueConverter` as well.

If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at or file a JIRA ticket
with INFRA.

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message