[ 
https://issues.apache.org/jira/browse/METRON-1644?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16535061#comment-16535061
 ] 

ASF GitHub Bot commented on METRON-1644:
----------------------------------------

Github user ottobackwards commented on the issue:

    https://github.com/apache/metron/pull/1084
  
    I'm looking for a doc that describes how these new things work, like what 
would have come out of a discuss thread if there had been discussion on this 
before hand.
    
    " Dev. design notes"
    "The way this works is ...   We use the configuration ago do this, and the 
new strategies to do that, basically setting the system up so that we can do 
x,y and z in this component.  See this code, that code and this code."  "Other 
ways to do this are foo and bar, but I chose this because cause blah".



> Support parser chaining
> -----------------------
>
>                 Key: METRON-1644
>                 URL: https://issues.apache.org/jira/browse/METRON-1644
>             Project: Metron
>          Issue Type: Improvement
>            Reporter: Casey Stella
>            Priority: Major
>
> Currently we have only one layer of parsing prior to enrichment, but often 
> real data is more complex.  For instance, often data is wrapped in an 
> envelope (e.g. syslog data which contains a field which needs to be parsed).
> This Jira allows us to support a DAG of parsers prior to enrichment by 
> allowing us to provide a strategy for interpreting what is data and what is 
> metadata in the parser bolt.  This enables upstream parsers to pass in a JSON 
> Blob which contains the metadata and have the parser bolt choose which field 
> is the data to be parsed, the remaining fields would be considered metadata 
> (and merged into the resulting data or not depending on our existing rules 
> for handling metadata).
>  
> To illustrate this better, I've provided a use-case with an example.  Note, 
> this PR depends on METRON-1643 and METRON-1642, so those should be reviewed 
> prior to this.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Reply via email to