metron-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Ali Nazemian <alinazem...@gmail.com>
Subject Stellar post-parsing transformation conditional statement
Date Fri, 09 Feb 2018 03:55:40 GMT
Hi All,

I was wondering how we can address if statement in the config section to
have a different mapping in certain conditions. The following syntax is not
acceptable.

{
"parserClassName": "org.apache.metron.parsers.asa.BasicAsaParser",
"filterClassName": null,
"sensorTopic": "test-asa",
"writerClassName": null,
"errorWriterClassName": null,
"invalidWriterClassName": null,
"parserConfig": {},
"fieldTransformations": [
{
"input": [],
"output": [
"x",
"y",
"z",
],
"transformation": "STELLAR",
"config": {
  IF "ip_src_port" == 39296 THEN
"x": "something",
"y": "something else"

  ELSE
"y": "something",
"z": "something else"
}
}
]
}

Regards,
Ali

Mime
View raw message