nifi-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Matt Gilman <>
Subject Re: ReplaceText duplicates
Date Thu, 10 Sep 2015 15:22:52 GMT

Since your dealing with JSON data, you may want to consider using
EvaluateJsonPath. It supports specifying XPath like expressions to extract
values and store into FlowFile attributes or content. If your extracting
into attributes, you can evaluate multiple paths. However, if your
extracting into FlowFile content you can only specify a single path.

I'll take a look at your template to see what's going on.


On Thu, Sep 10, 2015 at 11:00 AM, Christopher Wilson <>

> I've ran into an issue with ReplaceText on another thread but thought I'd
> move this over to it's own.
> What I have is a syslog entry from OpenStack that contains CADF (Cloud
> Audit Data Federation) JSON as the payload.  In the context of OpenStack
> these are login/security events that we'd like to see outside of a normal
> syslog stream and passed directly over to the security team.  I'd started
> down the path of ExtractText and pulling out the associated JSON into an
> attribute but found when I wired in a ReplaceText and tried to replace the
> content with the attribute 3 copies of the JSON data were written to the
> file content.
> What I've since learned is I can just replace the text in place without
> yanking into an attribute.  However, I can see cases where I might want to
> replace/append text using one or more attributes.  Wanted to see if other
> have handled this differently and if there is an enhancement request in the
> offing?
> I put the template I was working from, with a line of the syslog data, up
> on GitHub in case anyone wants to see this behavior in action.  You just
> have to play with turning processors on/off when viewing the full bulletin
> board.
> Thanks in advance.
> -Chris

View raw message