From user-return-1934-archive-asf-public=cust-asf.ponee.io@metron.apache.org Fri Feb 9 04:55:51 2018 Return-Path: X-Original-To: archive-asf-public@eu.ponee.io Delivered-To: archive-asf-public@eu.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by mx-eu-01.ponee.io (Postfix) with ESMTP id 5A80D18064F for ; Fri, 9 Feb 2018 04:55:51 +0100 (CET) Received: by cust-asf.ponee.io (Postfix) id 4A5A9160C5D; Fri, 9 Feb 2018 03:55:51 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 90471160C4A for ; Fri, 9 Feb 2018 04:55:50 +0100 (CET) Received: (qmail 9850 invoked by uid 500); 9 Feb 2018 03:55:49 -0000 Mailing-List: contact user-help@metron.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@metron.apache.org Delivered-To: mailing list user@metron.apache.org Received: (qmail 9840 invoked by uid 99); 9 Feb 2018 03:55:49 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd3-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 09 Feb 2018 03:55:49 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd3-us-west.apache.org (ASF Mail Server at spamd3-us-west.apache.org) with ESMTP id DA03F1802E6 for ; Fri, 9 Feb 2018 03:55:48 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd3-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 1.879 X-Spam-Level: * X-Spam-Status: No, score=1.879 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=2, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=disabled Authentication-Results: spamd3-us-west.apache.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mx1-lw-eu.apache.org ([10.40.0.8]) by localhost (spamd3-us-west.apache.org [10.40.0.10]) (amavisd-new, port 10024) with ESMTP id t4zm5OJVxdRe for ; Fri, 9 Feb 2018 03:55:47 +0000 (UTC) Received: from mail-lf0-f50.google.com (mail-lf0-f50.google.com [209.85.215.50]) by mx1-lw-eu.apache.org (ASF Mail Server at mx1-lw-eu.apache.org) with ESMTPS id 502D45F11F for ; Fri, 9 Feb 2018 03:55:47 +0000 (UTC) Received: by mail-lf0-f50.google.com with SMTP id a204so9369836lfa.2 for ; Thu, 08 Feb 2018 19:55:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=GRLkdSdOZuJ8Vtk2QEPJOkseJCoNCpnU+St/eRc5XBE=; b=SbpckVckIRH+ApFCPmqN2C7pURFg5Fs4P8TcmA0nW0WUVsxgJjS3BCJSkW4F0rIChY nVMuEyGK1jB+iFlrb+DeBKZWI3YScT/xccK7tscjeU/3piNv95geDdOtQPE5eRDcq3Jx HkIRY/7hqHTqwV3GsexRF2WUXPMvEizgpaIBi+sy/1SgPeET0PxTkDxI4n20nr7GBFhh 1h/v5cWd7boKwkEwIFuwE+IClQS+HNc232yjbTqAZ/bz6r7w45S0qUD/H/Qutn45I+Wr 20Kp+NrAOrXQFCzsq9FEQXJaHFC3hHgXhs7TtbC1B1M9Pa1ZzL8gP39lY+zdr5aewcG/ nRxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=GRLkdSdOZuJ8Vtk2QEPJOkseJCoNCpnU+St/eRc5XBE=; b=aDbYhkVodcVWp4zXIb6Go1YP4bk1LuHKbjzW/PPU9RxNp2RrtgFM6495OXZpK8Rct3 UpPWAhLyVZ0Z4kqHJV02nWN7HwWC2RpjGy23jAIt56QtkhUn1jZ41k9F8uxvQ3qOUCMr IzxXb4FfmRvzaN9+px1DEaRnpyg64fAI1HlPyp+kcUQdKFhuuplghyfYwIydyDtIem+A d9EEpzpgkUz7j4Dx5UvMRNNz8pW+smIeH2bNKwbe5j4dBeKq8NbqYHVHvEMLBshrgmps 1rOuIea+tDhuaswCc4Y/0hxxIyVt1BEdvIlEw/Of3vssBMSTC0VFRQg6QljMnvES5ZkM dBiQ== X-Gm-Message-State: APf1xPDpHMwydGWttnmZdwqCYiQJtKoqXDPINq/XJ45ZDwUSOJkhBLW7 g/19xYbg9Mh5/f8TyVNmIZjhhqn1JyQBI7zTNK8TUUnw X-Google-Smtp-Source: AH8x225CRxsBVoZzxrEELWkGPohFK/mJ8V8stpYsTrOSIFutoIgYrGM+scTEgkJrDoHHno5vZhubIIAxTMVoT8Rbiiw= X-Received: by 10.25.40.130 with SMTP id o124mr865566lfo.3.1518148540705; Thu, 08 Feb 2018 19:55:40 -0800 (PST) MIME-Version: 1.0 Received: by 10.46.101.8 with HTTP; Thu, 8 Feb 2018 19:55:40 -0800 (PST) From: Ali Nazemian Date: Fri, 9 Feb 2018 14:55:40 +1100 Message-ID: Subject: Stellar post-parsing transformation conditional statement To: user@metron.apache.org Content-Type: multipart/alternative; boundary="001a114082d27c31b70564bf802a" --001a114082d27c31b70564bf802a Content-Type: text/plain; charset="UTF-8" Hi All, I was wondering how we can address if statement in the config section to have a different mapping in certain conditions. The following syntax is not acceptable. { "parserClassName": "org.apache.metron.parsers.asa.BasicAsaParser", "filterClassName": null, "sensorTopic": "test-asa", "writerClassName": null, "errorWriterClassName": null, "invalidWriterClassName": null, "parserConfig": {}, "fieldTransformations": [ { "input": [], "output": [ "x", "y", "z", ], "transformation": "STELLAR", "config": { IF "ip_src_port" == 39296 THEN "x": "something", "y": "something else" ELSE "y": "something", "z": "something else" } } ] } Regards, Ali --001a114082d27c31b70564bf802a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi All,

I was wondering how we can addr= ess if statement in the config section to have a different mapping in certa= in conditions. The following syntax is not acceptable.

=
{
"pa= rserClassName": "org.apache.metron.parsers.asa.BasicAsaParser&quo= t;,
"filterClassName= ": null,
"senso= rTopic": "test-asa",
"writerClassName": null,
"errorWriterClassName": null,
"invalidWriterClassName": nul= l,
"parserConfig&quo= t;: {},
"fieldTransf= ormations": [
{
"input": [],
"output": [
"x",
<= span style=3D"white-space:pre"> "y",
"z",
],
= "transformation": "STELLAR",
"config": {
=C2=A0 IF "ip_src_port" =3D=3D 39= 296 THEN
"x"= : "something",
"y": "something else"

=C2=A0 ELSE
"y": "something",
= "z": "something e= lse"
}
<= span style=3D"white-space:pre"> }
]
}

Regards,
Ali
--001a114082d27c31b70564bf802a--