You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "Laurens Vets (JIRA)" <ji...@apache.org> on 2018/01/22 22:49:00 UTC
[jira] [Comment Edited] (METRON-1415) match statement does not seem
to work.
[ https://issues.apache.org/jira/browse/METRON-1415?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16335082#comment-16335082 ]
Laurens Vets edited comment on METRON-1415 at 1/22/18 10:48 PM:
----------------------------------------------------------------
I can confirm that the following match statement does indeed work:
{code:java}
AWSEventSourceAccount": "match
{recipientAccountId == '1111111111' => 'account1', recipientAccountId == '2222222222' => 'account2', recipientAccountId == '333333333' => 'account3', recipientAccountId == '4444444444' => 'account4', recipientAccountId == '555555555' => 'account4', recipientAccountId == '6666666666' => 'account6', default => 'Unknown Account.'}{code}
Thanks [~ottobackwards]
was (Author: laurensv):
I can confirm that the following match statement does indeed work:
"AWSEventSourceAccount": "match{recipientAccountId == '1111111111' => 'account1', recipientAccountId == '2222222222' => 'account2', recipientAccountId == '333333333' => 'account3', recipientAccountId == '4444444444' => 'account4', recipientAccountId == '555555555' => 'account4', recipientAccountId == '6666666666' => 'account6', default => 'Unknown Account.'}"
> match statement does not seem to work.
> --------------------------------------
>
> Key: METRON-1415
> URL: https://issues.apache.org/jira/browse/METRON-1415
> Project: Metron
> Issue Type: Bug
> Affects Versions: 0.4.2
> Reporter: Laurens Vets
> Assignee: Otto Fowler
> Priority: Major
>
> I had the following code in my Sensor Enrichment Config:
> {code:java}
> {
> "enrichment": {
> "fieldMap": {
> "stellar": {
> "config": {
> "AWSEventSourceAccount": "match{recipientAccountID == 1111111111L => 'account1', recipientAccountID == 2222222222L => 'account2', recipientAccountID == 333333333L => 'account3', recipientAccountID == 4444444444L => 'account4', recipientAccountID == 5555555555L => 'account4', recipientAccountID == 6666666666L => 'account6', default => 'Unknown Account.'}"
> }
> }
> },
> "fieldToTypeMap": {},
> "config": {}
> },{code}
> However, this did not work as expected and the AWSEventSourceAccount field would always return "Unknown Account" in my events.
> According to [~ottobackwards], this does work in the Stellar shell. He asked me to test with "_source.recipientAccountID" instead of "recipientAccountID" and make sure that mapStrategy is set to UNFOLD (this was already the case).
> However, using this in my enrichment config does not resolve the issue. I used:
> {code:java}
> {
> "enrichment": {
> "fieldMap": {
> "stellar": {
> "config": {
> "AWSEventSourceAccount": "match{_source.recipientAccountID == 1111111111L => 'account1', _source.recipientAccountID == 2222222222L => 'account2', _source.recipientAccountID == 333333333L => 'account3', _source.recipientAccountID == 4444444444L => 'account4', _source.recipientAccountID == 5555555555L => 'account4', _source.recipientAccountID == 6666666666L => 'account6', default => 'Unknown Account.'}"
> }
> }
> },
> "fieldToTypeMap": {},
> "config": {}
> },{code}
>
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)