[ https://issues.apache.org/jira/browse/METRON-1644?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16535097#comment-16535097 ]
ASF GitHub Bot commented on METRON-1644: ---------------------------------------- Github user cestella commented on the issue: https://github.com/apache/metron/pull/1084 @ottobackwards Ok, I attempted to do that [here](https://github.com/cestella/incubator-metron/blob/c4e4786e778d5b06cd16f7faa7d3522f620fc2ba/metron-platform/metron-parsers/ParserChaining.md). Can you help me understand where the gaps are. Is it one or more of the following: [ ] The document doesn't have enough detail about what was done before, just detail about the current architecture. [ ] The document does not link to relevant code examples to create custom raw message strategies. [ ] The document is too high level [ ] The document is too low level [ ] Other. Please specify details if this is checked. > Support parser chaining > ----------------------- > > Key: METRON-1644 > URL: https://issues.apache.org/jira/browse/METRON-1644 > Project: Metron > Issue Type: Improvement > Reporter: Casey Stella > Priority: Major > > Currently we have only one layer of parsing prior to enrichment, but often > real data is more complex. For instance, often data is wrapped in an > envelope (e.g. syslog data which contains a field which needs to be parsed). > This Jira allows us to support a DAG of parsers prior to enrichment by > allowing us to provide a strategy for interpreting what is data and what is > metadata in the parser bolt. This enables upstream parsers to pass in a JSON > Blob which contains the metadata and have the parser bolt choose which field > is the data to be parsed, the remaining fields would be considered metadata > (and merged into the resulting data or not depending on our existing rules > for handling metadata). > > To illustrate this better, I've provided a use-case with an example. Note, > this PR depends on METRON-1643 and METRON-1642, so those should be reviewed > prior to this. -- This message was sent by Atlassian JIRA (v7.6.3#76005)