You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@metron.apache.org by Youzha <yu...@gmail.com> on 2019/07/17 15:46:31 UTC
[ask] create profile for profiler with multiple fields on foreach
Hi,
it is possible to use multiple fields inside foreach on profiler ?
i’ve try using AND like below but it failed. pls help
{
"profiles": [
{
"profile": "hello-world",
"onlyif": "exists(ip_src_addr) AND exists(ip_dst_addr)",
"foreach": "ip_src_addr AND ip_dst_addr,
"init": { "count": "0" },
"update": { "count": "count + 1" },
"result": "count"
}
]
}
Re: [ask] create profile for profiler with multiple fields on foreach
Posted by tkg_cangkul <yu...@gmail.com>.
Hi Stefan,
Thanks a lot for your help. It works. :)
On 18/07/19 17:26, Stefan Kupstaitis-Dunkler wrote:
> Hi
>
> try the Stellar function JOIN to concatenate a list of strings
> instead. That should work.
> https://metron.apache.org/current-book/metron-stellar/stellar-common/index.html#JOIN
>
> Best,
> Stefan
>
> On Thu, Jul 18, 2019 at 5:13 AM tkg_cangkul <yuza.rasfar@gmail.com
> <ma...@gmail.com>> wrote:
>
> Hi Simon,
>
> I've try your suggestion but i found an error msg like this.
>
>
>
> On 17/07/19 23:17, Simon Elliston Ball wrote:
>> I suspect what you mean is a concatenation of the source and dest
>> to get the pairs as a foreach key, so you actually want something
>> like: "foreach": "ip_src_addr + '-' + ip_dst_addr"
>>
>> Simon
>>
>> On Wed, 17 Jul 2019 at 17:01, Anil Donthireddy
>> <Anil.Donthireddy@sstech.us <ma...@sstech.us>>
>> wrote:
>>
>> Hi,
>>
>> The expression provided in foreach statement is not valid. It
>> should resolve to single object string.
>>
>> Thanks,
>>
>> Anil.
>>
>> *From:*Youzha [mailto:yuza.rasfar@gmail.com
>> <ma...@gmail.com>]
>> *Sent:* Wednesday, July 17, 2019 9:17 PM
>> *To:* user@metron.apache.org <ma...@metron.apache.org>
>> *Subject:* [ask] create profile for profiler with multiple
>> fields on foreach
>>
>> Hi,
>>
>> it is possible to use multiple fields inside foreach on
>> profiler ?
>>
>> i’ve try using AND like below but it failed. pls help
>>
>> {
>>
>> "profiles": [
>>
>> {
>>
>> "profile": "hello-world",
>>
>> "onlyif": "exists(ip_src_addr) AND exists(ip_dst_addr)",
>>
>> "foreach": "ip_src_addr AND ip_dst_addr,
>>
>> "init": { "count": "0" },
>>
>> "update": { "count": "count + 1" },
>>
>> "result": "count"
>>
>> }
>>
>> ]
>>
>> }
>>
>>
>>
>> --
>> --
>> simon elliston ball
>> @sireb
>
>
>
> --
> Stefan Kupstaitis-Dunkler
> https://datahovel.com/
> https://twitter.com/StefanDunkler
Re: [ask] create profile for profiler with multiple fields on foreach
Posted by Stefan Kupstaitis-Dunkler <st...@gmail.com>.
Hi
try the Stellar function JOIN to concatenate a list of strings instead.
That should work.
https://metron.apache.org/current-book/metron-stellar/stellar-common/index.html#JOIN
Best,
Stefan
On Thu, Jul 18, 2019 at 5:13 AM tkg_cangkul <yu...@gmail.com> wrote:
> Hi Simon,
>
> I've try your suggestion but i found an error msg like this.
>
>
>
> On 17/07/19 23:17, Simon Elliston Ball wrote:
>
> I suspect what you mean is a concatenation of the source and dest to get
> the pairs as a foreach key, so you actually want something like: "foreach":
> "ip_src_addr + '-' + ip_dst_addr"
>
> Simon
>
> On Wed, 17 Jul 2019 at 17:01, Anil Donthireddy <An...@sstech.us>
> wrote:
>
>> Hi,
>>
>>
>>
>> The expression provided in foreach statement is not valid. It should
>> resolve to single object string.
>>
>>
>>
>> Thanks,
>>
>> Anil.
>>
>>
>>
>> *From:* Youzha [mailto:yuza.rasfar@gmail.com]
>> *Sent:* Wednesday, July 17, 2019 9:17 PM
>> *To:* user@metron.apache.org
>> *Subject:* [ask] create profile for profiler with multiple fields on
>> foreach
>>
>>
>>
>> Hi,
>>
>>
>>
>> it is possible to use multiple fields inside foreach on profiler ?
>>
>>
>>
>> i’ve try using AND like below but it failed. pls help
>>
>>
>>
>> {
>>
>> "profiles": [
>>
>> {
>>
>> "profile": "hello-world",
>>
>> "onlyif": "exists(ip_src_addr) AND exists(ip_dst_addr)",
>>
>> "foreach": "ip_src_addr AND ip_dst_addr,
>>
>> "init": { "count": "0" },
>>
>> "update": { "count": "count + 1" },
>>
>> "result": "count"
>>
>> }
>>
>> ]
>>
>> }
>>
>>
>
> --
> --
> simon elliston ball
> @sireb
>
>
>
--
Stefan Kupstaitis-Dunkler
https://datahovel.com/
https://twitter.com/StefanDunkler
Re: [ask] create profile for profiler with multiple fields on foreach
Posted by tkg_cangkul <yu...@gmail.com>.
Hi Simon,
I've try your suggestion but i found an error msg like this.
On 17/07/19 23:17, Simon Elliston Ball wrote:
> I suspect what you mean is a concatenation of the source and dest to
> get the pairs as a foreach key, so you actually want something like:
> "foreach": "ip_src_addr + '-' + ip_dst_addr"
>
> Simon
>
> On Wed, 17 Jul 2019 at 17:01, Anil Donthireddy
> <Anil.Donthireddy@sstech.us <ma...@sstech.us>> wrote:
>
> Hi,
>
> The expression provided in foreach statement is not valid. It
> should resolve to single object string.
>
> Thanks,
>
> Anil.
>
> *From:*Youzha [mailto:yuza.rasfar@gmail.com
> <ma...@gmail.com>]
> *Sent:* Wednesday, July 17, 2019 9:17 PM
> *To:* user@metron.apache.org <ma...@metron.apache.org>
> *Subject:* [ask] create profile for profiler with multiple fields
> on foreach
>
> Hi,
>
> it is possible to use multiple fields inside foreach on profiler ?
>
> i’ve try using AND like below but it failed. pls help
>
> {
>
> "profiles": [
>
> {
>
> "profile": "hello-world",
>
> "onlyif": "exists(ip_src_addr) AND exists(ip_dst_addr)",
>
> "foreach": "ip_src_addr AND ip_dst_addr,
>
> "init": { "count": "0" },
>
> "update": { "count": "count + 1" },
>
> "result": "count"
>
> }
>
> ]
>
> }
>
>
>
> --
> --
> simon elliston ball
> @sireb
Re: [ask] create profile for profiler with multiple fields on foreach
Posted by Simon Elliston Ball <si...@simonellistonball.com>.
I suspect what you mean is a concatenation of the source and dest to get
the pairs as a foreach key, so you actually want something like: "foreach":
"ip_src_addr + '-' + ip_dst_addr"
Simon
On Wed, 17 Jul 2019 at 17:01, Anil Donthireddy <An...@sstech.us>
wrote:
> Hi,
>
>
>
> The expression provided in foreach statement is not valid. It should
> resolve to single object string.
>
>
>
> Thanks,
>
> Anil.
>
>
>
> *From:* Youzha [mailto:yuza.rasfar@gmail.com]
> *Sent:* Wednesday, July 17, 2019 9:17 PM
> *To:* user@metron.apache.org
> *Subject:* [ask] create profile for profiler with multiple fields on
> foreach
>
>
>
> Hi,
>
>
>
> it is possible to use multiple fields inside foreach on profiler ?
>
>
>
> i’ve try using AND like below but it failed. pls help
>
>
>
> {
>
> "profiles": [
>
> {
>
> "profile": "hello-world",
>
> "onlyif": "exists(ip_src_addr) AND exists(ip_dst_addr)",
>
> "foreach": "ip_src_addr AND ip_dst_addr,
>
> "init": { "count": "0" },
>
> "update": { "count": "count + 1" },
>
> "result": "count"
>
> }
>
> ]
>
> }
>
>
--
--
simon elliston ball
@sireb
RE: [ask] create profile for profiler with multiple fields on
foreach
Posted by Anil Donthireddy <An...@sstech.us>.
Hi,
The expression provided in foreach statement is not valid. It should resolve to single object string.
Thanks,
Anil.
From: Youzha [mailto:yuza.rasfar@gmail.com]
Sent: Wednesday, July 17, 2019 9:17 PM
To: user@metron.apache.org
Subject: [ask] create profile for profiler with multiple fields on foreach
Hi,
it is possible to use multiple fields inside foreach on profiler ?
i’ve try using AND like below but it failed. pls help
{
"profiles": [
{
"profile": "hello-world",
"onlyif": "exists(ip_src_addr) AND exists(ip_dst_addr)",
"foreach": "ip_src_addr AND ip_dst_addr,
"init": { "count": "0" },
"update": { "count": "count + 1" },
"result": "count"
}
]
}