Thanks Casey!
--
Sent with Airmail
On September 27, 2016 at 14:33:08, Casey Stella (ceste...@gmail.com) wrote:
Yes, it is in the parser. You can assign a field to NULL and it will
remove it.
Consider the following example parser config which takes the foo field and
renames it to bar:
{
"parserClassName":"org.apache.metron.parsers.json.JSONMapParser",
"sensorTopic":"custom",
"parserConfig" : {
"mapStrategy" : "UNFOLD"
},"fieldTransformations" : [
{
"transformation" : "STELLAR"
,"output" : [ "bar", "foo" ]
,"config" : {
"bar" : "foo"
,"foo" : "NULL"
}
}
]
}
Note the output section, that defines the order in which the stellar
statements are executed. You first set bar to whatever is in foo. Then
you set foo to NULL, which will delete it. You will be left with just bar,
which will contain what is in foo.
Another way to do this is to use the REMOVE transformation
<
https://github.com/apache/incubator-metron/tree/master/metron-platform/metron-parsers#fieldtransformation-configuration>
in
combination with the stellar transformation:
{
"parserClassName":"org.apache.metron.parsers.json.JSONMapParser",
"sensorTopic":"custom",
"parserConfig" : {
"mapStrategy" : "UNFOLD"
},"fieldTransformations" : [
{
"transformation" : "STELLAR"
,"output" : [ "bar", "foo" ]
,"config" : {
"bar" : "foo"
}
},
{
"input" : "foo"
, "transformation" : "REMOVE"
}
]
}
Best,
Casey
On Tue, Sep 27, 2016 at 2:12 PM, Otto Fowler <ottobackwa...@gmail.com>
wrote:
> Is it possible to remove and rename fields with stellar?
> I have “foreign” json coming out of the JSONParser, and I need to rename
> some fields to the core metron json object names and possibly remove some
> other fields.
>
