metron-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From justinleet <>
Subject [GitHub] metron pull request #718: METRON-1135: Make Stellar field transformations ha...
Date Mon, 28 Aug 2017 12:08:43 GMT
Github user justinleet commented on a diff in the pull request:
    --- Diff: metron-platform/metron-parsers/ ---
    @@ -212,6 +212,49 @@ into `{ "protocol" : "TCP", "source.type" : "bro", ...}`
     * `STELLAR` : This transformation executes a set of transformations
       expressed as [Stellar Language](../metron-common) statements.
    +### Assignment to `null`
    +If, in your field transformation, you assign a field to `null`, the field will be removed.
    +You can use this capability to rename variables.
    +Consider this example:
    + "fieldTransformations" : [
    +         { "transformation" : "STELLAR"
    +         ,"output" : [ "new_field", "old_field"]
    +         ,"config" : {
    +           "new_field" : "old_field"
    +          ,"old_field" : "null"
    +                     }
    +         }
    + ]
    +This would set `new_field` to the value of `old_field` and remove `old_field`.
    +### Warning: Transforming the same field twice
    +Currently, the stellar expressions are expressed in the form of a map where the keys
    +the fields and the values define the Stellar expressions.  You order the expression evaluation
    +in the `output` field.  A consequence of this choice to store the assignments as a map
is that
    +the same field cannot appear in the map as a key twice.
    +For instance, the following will not function as expected:
    --- End diff --
    I think this should be reworded. It's not that it doesn't function as expected; that would
imply a bug or an improvement that needs to happen.

If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at or file a JIRA ticket
with INFRA.

View raw message